# victoria-metrics-k8s-stack Helm values # The chart installs the VictoriaMetrics operator + CRDs and creates VMSingle, # VMAgent, VMAlert, VMAlertmanager CRs. # --------------------------------------------------------------------------- # VictoriaMetrics single-binary (the metrics database) # --------------------------------------------------------------------------- vmsingle: enabled: true spec: retentionPeriod: 7d storage: storageClassName: longhorn accessModes: - ReadWriteOnce resources: requests: storage: 20Gi resources: requests: cpu: 100m memory: 256Mi limits: cpu: "1" memory: 1Gi # --------------------------------------------------------------------------- # vmagent — scrapes node-exporter, kube-state-metrics, kubelet, etc. # The docker host runs its own vmagent that remote_writes through # vm-internal.lan (the Traefik Ingress → this vmsingle). # --------------------------------------------------------------------------- vmagent: enabled: true spec: selectAllByDefault: true scrapeInterval: 20s tolerations: - key: ENC[AES256_GCM,data:p5wXFYrKgl5m,iv:fLk95ZTQFGbEGqLHvbf28D/0y8xYXW54U6GovnGW6yE=,tag:OeKKhGkkdSmWk2dN+a4u8g==,type:str] value: ENC[AES256_GCM,data:ZIfocZ/TDf0=,iv:cLDyrqcPMpB31YlilwATny/gSl0JTm+Y+JIz7zLom7k=,tag:3r4mEkloOUaFLYK5Fsh7fw==,type:str] operator: Equal effect: NoSchedule - key: ENC[AES256_GCM,data:s3T0ERPTJrLu8LsPXvbZymaUQVFCWEKgUAO/EBM9oC0uYiQglg==,iv:rCvUYD4UGOxxs7/0OALejgJcQCIP33gwkoqzkh9gsZs=,tag:tf6HYI+gQjhlAn9uChxHuw==,type:str] operator: Exists effect: NoSchedule # --------------------------------------------------------------------------- # kube-state-metrics + node-exporter (metrics sources) # --------------------------------------------------------------------------- kube-state-metrics: enabled: true prometheus-node-exporter: enabled: true # --------------------------------------------------------------------------- # Grafana (UI) — served behind ingress at grafana.lan. # --------------------------------------------------------------------------- grafana: enabled: true persistence: enabled: true storageClassName: longhorn accessModes: - ReadWriteOnce size: 5Gi adminUser: admin # SOPS encrypts this when the file is processed. adminPassword: ENC[AES256_GCM,data:rjPnl/0NyMwC86rUwfpRG5wFtxrHWQ==,iv:LSRbGZjURvIMjmNKR28e9rfL3jo3ZsiW8Ozb84jWN8w=,tag:3YR7KETC1lO87eMyNn3HxQ==,type:str] # Provision a Loki datasource alongside the chart's default VictoriaMetrics # datasource so metric/log correlation works in one UI. datasources: datasources.yaml: apiVersion: ENC[AES256_GCM,data:dg==,iv:m6BuMFw4upbygkDeLvwI8NmYpYn+NatKh6lgxrS2UBs=,tag:f0ULmfZ93jovnjvaq7zKmQ==,type:int] datasources: - name: ENC[AES256_GCM,data:Wm/M5A==,iv:7SvYjrolqbLMpIQgfOHl4lkH4gTj7SAzZX+AuoNZe8w=,tag:SDuPA6OAgsf14QA7adRUrg==,type:str] type: ENC[AES256_GCM,data:yGr8tg==,iv:Twm/5k0nOIfxkzFcu+0x6cCmrqW9+fcCIngS3SBJwpY=,tag:xJmtgiNK9qZ4PjB9eInK3w==,type:str] url: ENC[AES256_GCM,data:RAXXmqxnh6fTBRhUckWqjfU0//R4HFe7ncX9IVxpcFCHRJBnFPQzpNOQ3so5eXLG,iv:DdeMsHUGeZn4OajvfkOvJu3ssXVS48VeuwsmuxC15Uw=,tag:u8LK4fzFLduEZOaLQu1ENA==,type:str] access: ENC[AES256_GCM,data:XYMbfTU=,iv:nJaI1lpKz8LQZZyUoviMDSCYz5kX2MScx8dQ3Rs1cFQ=,tag:IaGW2VjemZDDe8NtA2SxkA==,type:str] isDefault: ENC[AES256_GCM,data:qL0tZQY=,iv:zYhc1v5qjvhZki0mp1BzJHOhLirdWuGmwUm9U+kX5E0=,tag:4dMBF3cKylisTpsSZyJlrA==,type:bool] jsonData: maxLines: ENC[AES256_GCM,data:ozoVNw==,iv:xgfS63l48wi/hWXqsCqoKh2QWveSZFkLvW717i5tEK4=,tag:HDfwHIFJ3HsCqPttMEzMUg==,type:int] ingress: enabled: true ingressClassName: traefik annotations: external-dns.alpha.kubernetes.io/enabled: "true" hosts: - grafana.lan path: / pathType: Prefix tls: [] # --------------------------------------------------------------------------- # vmalert — evaluates VMRule CRs against VictoriaMetrics, forwards firing # alerts to Alertmanager. selectAllByDefault picks up all VMRules in the # namespace (including our vmalert-rules.yaml VMRule CR). # --------------------------------------------------------------------------- vmalert: enabled: true spec: selectAllByDefault: true evaluationInterval: 20s notifiers: - url: http://vm-victoria-metrics-k8s-stack-alertmanager.observability.svc.cluster.local:9093 resources: requests: cpu: 50m memory: 64Mi limits: cpu: 200m memory: 128Mi # --------------------------------------------------------------------------- # Alertmanager — 1 replica; inline config with a single n8n webhook receiver. # n8n runs on the docker host and fans out to email/Telegram/whatever. # --------------------------------------------------------------------------- alertmanager: enabled: true spec: replicaCount: 1 port: "9093" selectAllByDefault: true storage: storageClassName: longhorn accessModes: - ReadWriteOnce resources: requests: storage: 2Gi resources: requests: cpu: 50m memory: 64Mi limits: cpu: 200m memory: 128Mi config: route: receiver: n8n-webhook group_wait: 30s group_interval: 5m repeat_interval: 4h receivers: - name: n8n-webhook webhook_configs: - url: http://n8n.lan/webhook/observability-alert send_resolved: true extraRules: node-alerts: groups: - name: node rules: - alert: HighNodeCPU expr: 100 - (avg by (instance) (rate(node_cpu_seconds_total{mode="idle"}[5m])) * 100) > 80 for: 10m labels: severity: warning annotations: summary: High CPU on {{ $labels.instance }} description: CPU usage above 80% for 10 minutes. - alert: HighNodeRAM expr: 100 - ((node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes) * 100) > 85 for: 10m labels: severity: warning annotations: summary: High RAM on {{ $labels.instance }} description: RAM usage above 85% for 10 minutes. - alert: LowDiskSpace expr: | 100 - ((node_filesystem_avail_bytes{mountpoint!~"/run.*|/var/lib/docker.*"} / node_filesystem_size_bytes{mountpoint!~"/run.*|/var/lib/docker.*"}) * 100) > 85 for: 10m labels: severity: warning annotations: summary: Low disk space on {{ $labels.instance }} {{ $labels.mountpoint }} description: Disk usage above 85% for 10 minutes. sops: lastmodified: "2026-07-28T16:25:59Z" mac: ENC[AES256_GCM,data:XpZur78AoXUOajGBAnlZQ/mB0qJXcMp9tCzvxCY7AGvVZxvpg943WPEfFqRCHtqHexUEaSONG/u0H2vXrB8kR4PvFjMPsKkgwH0/6dROMXpTAhXk/n5gpLYW8v/YZU+vJGMXyoN74k87zGi8G1A5jdHXOvM0ruJxH/IUFRiaZR8=,iv:EhMJICuwLI1LJIc21V43GDCYNVd3A6ARe0HHB6i4EY8=,tag:MnJIrylw8z7re4+jEr13wg==,type:str] pgp: - created_at: "2026-07-28T16:25:59Z" enc: |- -----BEGIN PGP MESSAGE----- hQIMA7uy4qQr71wiAQ/6A6VVvTWAXZTaF+x6sG6KTj+GlqMVKESwG7Zg7YKjr1g+ Fn8QGcknpy+DcIBwL7UXxLYoPA7U7PETsvE4VpWBgLdVpdWUI8YYJU+pulvJs5W1 tDelmM8C9Dc6LASoyoZbncfsXuCFFCcFj1z3M8IUr3Yq9BMMNucgEzG1X3bV5Cti VJhHD8O3HEg9DQHa0pGPvm9hyCtYbktl8K2gWnBdnfA39u3JbpjTeUTiEzXxht8j 2tMQ2BW1KyJJdgH5kXqP/q6n+ULUmCNsgYSezDebIDV8+LET22LTmEerKSO/GO48 GgMbtOmEYnlaIJ7bUjJLoBBhYYFJBuHYTCvgs+FKTwQcZUenghWSQvvk2Vn+5Ycz aeb5cWYG64qoi4qPoufBfQ65VeLWTJrqKFAGjPfPoGiulnEaWraSlnThOemsYjaS Y+mheG2KkP75wZyzTuf0MtXie90uPd0w9gmsrzpEIB+z4hrrjX+SkrtehPOpq7jr OXu/3BJKdY8wHxUGmlymBHMQQyV/EooGsegO+meHfZOHcIShtL0AN7x4EzK0/Ef7 m0sEHKbPrqgBd/A9lw9lG4Q/EYPK5/e44O0xccbruP+MHwWVSbwxPBovEhiEesil SPHwjntaniNQy+sfLNaNeV3OOdOgiWd+KhWYaRHTHEfP6evaK6vTlTcG7iStM2LS XgHTiGg7iODwnoNDX5lykgMWRI77Red4OWW6tq/8LOGSlw0I+beYIqPN6kU3UA3D pdW4qan2jHJ3QJ0XEukz8u3CnntjLbG/saLsfB3XV0ylksC2eqe/t5yI0pvBi8c= =Jhru -----END PGP MESSAGE----- fp: DC6910268E657FF70BA7EC289974494E76938DDC encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$ version: 3.10.2