# victoria-metrics-k8s-stack Helm values # The chart installs the VictoriaMetrics operator + CRDs and creates VMSingle, # VMAgent, VMAlert, VMAlertmanager CRs. # --------------------------------------------------------------------------- # VictoriaMetrics single-binary (the metrics database) # --------------------------------------------------------------------------- vmsingle: enabled: true spec: retentionPeriod: 7d storage: storageClassName: longhorn accessModes: - ReadWriteOnce resources: requests: storage: 20Gi resources: requests: cpu: 100m memory: 256Mi limits: cpu: "1" memory: 1Gi # --------------------------------------------------------------------------- # vmagent — scrapes node-exporter, kube-state-metrics, kubelet, etc. # The docker host runs its own vmagent that remote_writes through # vm-internal.lan (the Traefik Ingress → this vmsingle). # --------------------------------------------------------------------------- vmagent: enabled: true spec: selectAllByDefault: true scrapeInterval: 20s tolerations: - key: ENC[AES256_GCM,data:SyutB0y9QtqQ,iv:EKRXNGtUovQYsESHFQTGygP09O2UWtLuBEQQcYZm3Oc=,tag:zh7CYOZleSgbbQhYZvcT+w==,type:str] value: ENC[AES256_GCM,data:So+8xmHYSxs=,iv:7sfUBAaMZd7imjVx14lusVn58cJQ4HpTkaPy5Eal2dY=,tag:hRBjT6wuEfG3Z+ZiPJhwQQ==,type:str] operator: Equal effect: NoSchedule - key: ENC[AES256_GCM,data:lj9OurynU8pRt4/MhgyevjmV0b7Zq+WG/9+zRRvPeA+RYZsV+A==,iv:LjuhErDT0bDlLcpo/AlNykz8Xu89B+nx1ja+HkPNXwo=,tag:5xM6XHrCdEejE7ituQ8W4Q==,type:str] operator: Exists effect: NoSchedule # --------------------------------------------------------------------------- # kube-state-metrics + node-exporter (metrics sources) # --------------------------------------------------------------------------- kube-state-metrics: enabled: true prometheus-node-exporter: enabled: true # --------------------------------------------------------------------------- # Grafana (UI) — served behind ingress at grafana.lan. # --------------------------------------------------------------------------- grafana: enabled: true persistence: enabled: true storageClassName: longhorn accessModes: - ReadWriteOnce size: 5Gi adminUser: admin # SOPS encrypts this when the file is processed. adminPassword: ENC[AES256_GCM,data:vpPvJA/PktMnsg/IovYfsD4lDBndUw==,iv:b4eLMEcUMJj4BwyeYw1kw2sZuieyr2xL9et+R7ss0BU=,tag:u0RcTp6mkQNAGkblG4/xww==,type:str] # Provision a Loki datasource alongside the chart's default VictoriaMetrics # datasource so metric/log correlation works in one UI. datasources: datasources.yaml: apiVersion: ENC[AES256_GCM,data:Uw==,iv:KYTMBV53yMbojMaqNinYpm/Uj5ylV86jcdJTdxuy+G0=,tag:IbIpiSBQFw7YSTQg0WRGqg==,type:int] datasources: - name: ENC[AES256_GCM,data:BPfR8Q==,iv:MkMhH3IJfBZzbIcqQw7y6bfJB/4Ew4feZNugjovk5O0=,tag:jaa43tzIXkE8kWZp2R/kcg==,type:str] type: ENC[AES256_GCM,data:WWncww==,iv:hPqJE0KCidSBnf11wxFH+Je+YKztWmeToBqi39Qf4ZQ=,tag:c9enJ2VgQqDJVbasvgG+Dw==,type:str] url: ENC[AES256_GCM,data:YkS66tpWXpW62Dtful0KNCwoZ3rG3nQtDBUsNQUwdQ+eqtG38JTrAudQqnsRD51q,iv:Mu3Sc6T2xypdot9dA1DHc8nD7UI8372nqlveLITR82E=,tag:1VmmIg+xR9qjWcvPKVYsJQ==,type:str] access: ENC[AES256_GCM,data:af3GpjE=,iv:MAYKfklF+wCC/XN+4snebjPAnW4KpYzaMMGYds7rG18=,tag:X+oFiDAiCb1f7cfREqFT7A==,type:str] isDefault: ENC[AES256_GCM,data:Zgu4Hn8=,iv:nnVB/in75nPAQos0Dfl6abBrHwT8tCt5X7lcCYBZbLc=,tag:u1UvkSj6SjcMm06NzKMGDA==,type:bool] jsonData: maxLines: ENC[AES256_GCM,data:88JJqA==,iv:lKsZa024I6223UEu0SHuZ3N9LZrzw0WBTfC+L2/3ljI=,tag:YvqieXK36xMmC/sSJ11NIg==,type:int] ingress: enabled: true ingressClassName: traefik annotations: external-dns.alpha.kubernetes.io/enabled: "true" hosts: - grafana.lan path: / pathType: Prefix tls: [] # --------------------------------------------------------------------------- # vmalert — evaluates VMRule CRs against VictoriaMetrics, forwards firing # alerts to Alertmanager. selectAllByDefault picks up all VMRules in the # namespace (including our vmalert-rules.yaml VMRule CR). # --------------------------------------------------------------------------- vmalert: enabled: true spec: selectAllByDefault: true evaluationInterval: 20s notifiers: - url: http://vm-victoria-metrics-k8s-stack-alertmanager.observability.svc.cluster.local:9093 resources: requests: cpu: 50m memory: 64Mi limits: cpu: 200m memory: 128Mi # --------------------------------------------------------------------------- # Alertmanager — 1 replica; inline config with a single n8n webhook receiver. # n8n runs on the docker host and fans out to email/Telegram/whatever. # --------------------------------------------------------------------------- alertmanager: enabled: true spec: replicaCount: 1 port: "9093" selectAllByDefault: true storage: volumeClaimTemplate: spec: storageClassName: longhorn accessModes: - ReadWriteOnce resources: requests: storage: 2Gi resources: requests: cpu: 50m memory: 64Mi limits: cpu: 200m memory: 128Mi config: route: receiver: n8n-webhook group_wait: 30s group_interval: 5m repeat_interval: 4h receivers: - name: n8n-webhook webhook_configs: - url: http://n8n.lan/webhook/observability-alert send_resolved: true extraRules: node-alerts: groups: - name: node rules: - alert: HighNodeCPU expr: 100 - (avg by (instance) (rate(node_cpu_seconds_total{mode="idle"}[5m])) * 100) > 80 for: 10m labels: severity: warning annotations: summary: High CPU on {{ $labels.instance }} description: CPU usage above 80% for 10 minutes. - alert: HighNodeRAM expr: 100 - ((node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes) * 100) > 85 for: 10m labels: severity: warning annotations: summary: High RAM on {{ $labels.instance }} description: RAM usage above 85% for 10 minutes. - alert: LowDiskSpace expr: | 100 - ((node_filesystem_avail_bytes{mountpoint!~"/run.*|/var/lib/docker.*"} / node_filesystem_size_bytes{mountpoint!~"/run.*|/var/lib/docker.*"}) * 100) > 85 for: 10m labels: severity: warning annotations: summary: Low disk space on {{ $labels.instance }} {{ $labels.mountpoint }} description: Disk usage above 85% for 10 minutes. sops: lastmodified: "2026-07-28T16:39:09Z" mac: ENC[AES256_GCM,data:Ymxmmkui0Nuv35Yq6v4BXM4xGhvjAufexW7fIm9fUIdTTXZ3e10PitNCZXKiaDwwCJfdEkNZri7jPAYzhTzKMIdcTKnOMImsMjdiJZwRwwbKcYVay0A6KSLJ8eFjDRRYhlCXbsAIRlQHpFh4UkssKdu40mIiudU0qIVm04ppbno=,iv:R8kpITPYSbQ1yZw5IK0fArssxUtIjNmvzknOrLJQcuk=,tag:/CRcr1VZAIKIPbcag05uTw==,type:str] pgp: - created_at: "2026-07-28T16:39:08Z" enc: |- -----BEGIN PGP MESSAGE----- hQIMA7uy4qQr71wiARAAmOxyx5eH5Jykp/GDL79REgf61iGujtPiUVy8CT3o7O5k tTGma6rRXK5wZV/iGN3wOQehF19Oy2iYwMfxilRwpB69RFwyKPKdHDDWMWNXv5Th wJnNjVjWZ0xiRautWPn/TjDOJZ6j6p7lQ3IcQ3vzuap1RVRIXv081DxJGR9JbeYl khmrl1+zecwxS87JK+fLko9NIBb5JgFEtEf1RvLyFak8nZu5cNCu+PCykALvUaO7 V5NAaF1aV9cdz8G9TZWmHZsIlDDE9/oro2aLR7cr8uxnKQhWerttqvyDYNwYzNKW qgsUplTxTmyuc9DdnLDfJ55Ncuv9qS5/4/p5GpsHrteD6oiPNjXaxR8cBVFLvGwp kQb/VZgOGAnkYlMCUG8APiwRhbpAlyy51hKBqVh+a9iRlzZEWHKlxcvIrcFAQaHt sDXyg36F0GCoHiMAqHKG0kRcbTV7Sq0JZVoLU/qxvaDfqvyCZO7X/U/YsSWNbWL0 emyBfeSvBX9h62NJx2aw8xKyiL+aeVfzSKAaXHMd/r4gKxBw/kVHAljKwRzbL85j UHeLUvqVkXs1mtIqGgUnpCcAVuV83omgcOwF44FitG/f9GCx+UWTvScwaw5ywuG3 J/4fOaA3K0Z4e/mOejARd4jLSPktSRpA01k9kjYY8UBn7TzQ0LrMLj5dxh8BpWrS XgECZapi+q6IjIses7+JqkWiP25hcglhqK3LAiUapA0c5UmAa5Vf7jfnkFm8eUdZ bA7ZnhX8nxK9n7JdSxrZhrbPWMO8hF/XKi7KTZMvgXFlb4/qP96y7oeqzKYcnvE= =pmSq -----END PGP MESSAGE----- fp: DC6910268E657FF70BA7EC289974494E76938DDC encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$ version: 3.10.2