feat: kube-prometeus-stack

prometheus-stack/.env.example

@@ -0,0 +1,2 @@
+GRAFANA_ADMIN_USER=admin
+GRAFANA_ADMIN_PASSWORD=changeme

prometheus-stack/alertmanager.yaml

@@ -0,0 +1,5 @@
+route:
+  receiver: default
+
+receivers:
+  - name: default

prometheus-stack/compose.yaml

@@ -0,0 +1,66 @@
+services:
+  grafana:
+    image: grafana/grafana:11.6.0
+    container_name: prometheus-grafana
+    restart: unless-stopped
+    env_file:
+      - .env
+    environment:
+      GF_SECURITY_ADMIN_USER: ${GRAFANA_ADMIN_USER:-admin}
+      GF_SECURITY_ADMIN_PASSWORD: ${GRAFANA_ADMIN_PASSWORD:?grafana admin password required}
+    volumes:
+      - grafana-data:/var/lib/grafana
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.prometheus-grafana.loadbalancer.server.port=3000"
+
+      # Prod Router
+      - "traefik.http.routers.grafana.rule=Host(`grafana.forust.xyz`)"
+      - "traefik.http.routers.grafana.entrypoints=websecure"
+      - "traefik.http.routers.grafana.tls=true"
+      # Local Router
+      - "traefik.http.routers.grafana-local.rule=Host(`grafana.workstation.internal`)"
+      - "traefik.http.routers.grafana-local.entrypoints=websecure"
+      - "traefik.http.routers.grafana-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.grafana-dev.rule=Host(`grafana.gigaforust.internal`)"
+      - "traefik.http.routers.grafana-dev.entrypoints=websecure"
+      - "traefik.http.routers.grafana-dev.tls=true"
+    networks:
+      - proxy
+
+  prometheus:
+    image: prom/prometheus:v3.2.1
+    container_name: prometheus-prometheus
+    restart: unless-stopped
+    command:
+      - "--config.file=/etc/prometheus/prometheus.yaml"
+      - "--storage.tsdb.path=/prometheus"
+      - "--storage.tsdb.retention.time=90d"
+    volumes:
+      - prometheus-data:/prometheus
+      - ./prometheus.yaml:/etc/prometheus/prometheus.yaml:ro
+    networks:
+      - proxy
+
+  alertmanager:
+    image: prom/alertmanager:v0.28.1
+    container_name: prometheus-alertmanager
+    restart: unless-stopped
+    command:
+      - "--config.file=/etc/alertmanager/alertmanager.yaml"
+      - "--storage.path=/alertmanager"
+    volumes:
+      - alertmanager-data:/alertmanager
+      - ./alertmanager.yaml:/etc/alertmanager/alertmanager.yaml:ro
+    networks:
+      - proxy
+
+volumes:
+  grafana-data:
+  prometheus-data:
+  alertmanager-data:
+
+networks:
+  proxy:
+    external: true

prometheus-stack/k8s/grafana-values.yaml

@@ -0,0 +1,52 @@
+grafana:
+  grafana.ini:
+    server:
+      domain: grafana.forust.xyz
+      root_url: https://grafana.forust.xyz
+    auth.anonymous:
+      enabled: false
+    users:
+      allow_sign_up: false
+  admin:
+    existingSecret: grafana-admin
+    userKey: admin-user
+    passwordKey: admin-password
+
+  persistence:
+    enabled: true
+    size: 10Gi
+
+  ingress:
+    enabled: false
+
+  service:
+    port: 80
+
+prometheus:
+  prometheusSpec:
+    storageSpec:
+      volumeClaimTemplate:
+        spec:
+          storageClassName: "local-path"
+          accessModes:
+            - ReadWriteOnce
+          resources:
+            requests:
+              storage: 40Gi
+    resources:
+      requests:
+        memory: "700Mi"
+        cpu: 200m
+      limits:
+        memory: "2Gi"
+alertmanager:
+  alertmanagerSpec:
+    storage:
+      volumeClaimTemplate:
+        spec:
+          accessModes:
+            - ReadWriteOnce
+
+          resources:
+            requests:
+              storage: 20Gi

prometheus-stack/k8s/ingress.yaml

@@ -0,0 +1,36 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: grafana-prod
+  namespace: prometheus
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`grafana.forust.xyz`)
+      kind: Rule
+      middlewares:
+        - name: "crowdsec-crowdsec-bouncer@kubernetescrd"
+        - name: "security-chain@file"
+      services:
+        - name: prometheus-stack-grafana
+          port: 80
+  tls:
+    certResolver: letsencrypt
+    domains:
+      - main: grafana.forust.xyz
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: grafana-local
+  namespace: prometheus
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: HostRegexp(`^grafana\.(workstation|gigaforust)\.internal$`)
+      kind: Rule
+      services:
+        - name: prometheus-stack-grafana
+          port: 80

prometheus-stack/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: prometheus

prometheus-stack/k8s/secrets.yaml.example

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: grafana-admin
+  namespace: prometheus
+type: Opaque
+stringData:
+  admin-user: "admin"
+  admin-password: ""

prometheus-stack/k8s/traefik-metrics.yaml

@@ -0,0 +1,16 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: traefik-monitor
+  namespace: prometheus
+  labels:
+    release: prometheus-stack
+spec:
+  namespaceSelector:
+    any: true
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: traefik
+  endpoints:
+    - port: metrics
+      interval: 15s

prometheus-stack/prometheus.yaml

@@ -0,0 +1,8 @@
+global:
+  scrape_interval: 15s
+  evaluation_interval: 15s
+
+scrape_configs:
+  - job_name: prometheus
+    static_configs:
+      - targets: ["localhost:9090"]