mirror of
https://github.com/vhaudiquet/homeprod.git
synced 2026-09-21 16:36:05 +00:00
251 lines
11 KiB
YAML
251 lines
11 KiB
YAML
# victoria-metrics-k8s-stack Helm values
|
|
# The chart installs the VictoriaMetrics operator + CRDs and creates VMSingle,
|
|
# VMAgent, VMAlert, VMAlertmanager CRs.
|
|
# ---------------------------------------------------------------------------
|
|
# VictoriaMetrics single-binary (the metrics database)
|
|
# ---------------------------------------------------------------------------
|
|
vmsingle:
|
|
enabled: true
|
|
spec:
|
|
retentionPeriod: 7d
|
|
storage:
|
|
storageClassName: longhorn
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
resources:
|
|
requests:
|
|
storage: 20Gi
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 1Gi
|
|
# ---------------------------------------------------------------------------
|
|
# vmagent — scrapes node-exporter, kube-state-metrics, kubelet, etc.
|
|
# The docker host runs its own vmagent that remote_writes through
|
|
# vm-internal.lan (the Traefik Ingress → this vmsingle).
|
|
# ---------------------------------------------------------------------------
|
|
vmagent:
|
|
enabled: true
|
|
spec:
|
|
selectAllByDefault: true
|
|
scrapeInterval: 20s
|
|
tolerations:
|
|
- key: ENC[AES256_GCM,data:ObyzBcZsnqG5,iv:2YZGA40pHj1LwUxSI6iS6i+YajmXdOrzsdg5FfpsfbA=,tag:AKfrwE+qN9usqW/KwRdnvA==,type:str]
|
|
value: ENC[AES256_GCM,data:5QZSm1cB9r4=,iv:a6iv6SEvHegPNEyTtyXel5nCFWsVsqQSb6x0NFEMJAU=,tag:hVZcZqqsYfeausuGgWf2RA==,type:str]
|
|
operator: Equal
|
|
effect: NoSchedule
|
|
- key: ENC[AES256_GCM,data:pe9O4WDtS2wKj+kBMyvK46W1JXELB7P+0sC12OoHWDifeHbbHg==,iv:NNIxYquZCHtwwQOn+GLPRVqP5Bm1+tkJddJximPiGs4=,tag:KGdbdUdT5Pz48X1dY2PfOA==,type:str]
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
# ---------------------------------------------------------------------------
|
|
# kube-state-metrics + node-exporter (metrics sources)
|
|
# ---------------------------------------------------------------------------
|
|
kube-state-metrics:
|
|
enabled: true
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 256Mi
|
|
prometheus-node-exporter:
|
|
enabled: true
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 50Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 128Mi
|
|
# ---------------------------------------------------------------------------
|
|
# VM operator (the Deployment created by this chart, not a CR). Without
|
|
# requests, when the API server stalls and elects a new leader, the operator
|
|
# pod gets killed by the kubelet on node pressure before it can re-acquire
|
|
# the lease. Small request keeps it alive.
|
|
# ---------------------------------------------------------------------------
|
|
operator:
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 256Mi
|
|
# ---------------------------------------------------------------------------
|
|
# Grafana (UI) — served behind ingress at grafana.lan.
|
|
# ---------------------------------------------------------------------------
|
|
grafana:
|
|
enabled: true
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
sidecar:
|
|
dashboards:
|
|
env:
|
|
REQ_TIMEOUT: "120"
|
|
REQ_RETRY_CONNECT: "10"
|
|
REQ_RETRY_READ: "10"
|
|
REQ_RETRY_TOTAL: "20"
|
|
IGNORE_ALREADY_PROCESSED: "true"
|
|
datasources:
|
|
env:
|
|
REQ_TIMEOUT: "120"
|
|
REQ_RETRY_CONNECT: "10"
|
|
REQ_RETRY_READ: "10"
|
|
REQ_RETRY_TOTAL: "20"
|
|
IGNORE_ALREADY_PROCESSED: "true"
|
|
persistence:
|
|
enabled: true
|
|
storageClassName: longhorn
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
size: 5Gi
|
|
adminUser: admin
|
|
# SOPS encrypts this when the file is processed.
|
|
adminPassword: ENC[AES256_GCM,data:Caz9+0gCg9tGW937xMdDj6yJAKaz4g==,iv:5BAt1p1zpdaabizJDfGzCymb+QESq9lqHCT8cdVqs3E=,tag:NksoLtm5QRN7kO8mTgjFvQ==,type:str]
|
|
# Provision a Loki datasource alongside the chart's default VictoriaMetrics
|
|
# datasource so metric/log correlation works in one UI.
|
|
datasources:
|
|
datasources.yaml:
|
|
apiVersion: ENC[AES256_GCM,data:hg==,iv:3t/7j0toxZ31JhpOZoOz3WjjoWGhutg5Ga5WGJjnRZo=,tag:bSDD3h0xoQcffslmuBPOUw==,type:int]
|
|
datasources:
|
|
- name: ENC[AES256_GCM,data:w0CKrw==,iv:sJJWcnHqVGWQg70DEOtO8U8NdIKqxNux8T3N9y6xn0E=,tag:MuozFD6M3n/6Gua+c6ASMA==,type:str]
|
|
type: ENC[AES256_GCM,data:oPo9vA==,iv:l5itcQZ79LA5n7RYQ+mF5ZKlFHdF+3w+bC/4cDnaWkU=,tag:q7avCfUl6DmqBZe5VHQCTw==,type:str]
|
|
url: ENC[AES256_GCM,data:PjGswrAD+Y3aqWHmuV60ppWrY+pmnVeezfI8BiD0h2CeAh0Yt0LxvMIIqPnvYbQT,iv:oEavqV6YMYI+iZ+tGs70N2moVRuBrSYDlruS2YjeyZg=,tag:nEJOneNf321DnnwW/y5DQQ==,type:str]
|
|
access: ENC[AES256_GCM,data:QC4cUVs=,iv:TGlJgdVlvsnLO4AlinMJ5pX8LLSz7E1XmFZRyvo/RAc=,tag:vAEwvlTdHWfitJO/E/86fw==,type:str]
|
|
isDefault: ENC[AES256_GCM,data:kmIxwOE=,iv:3aUjEF/CNF48xnV4/ZLLMI6XQ6N9sSW7lD8ndeJOf4M=,tag:8eqVGpyu0vtxubRFyJNspg==,type:bool]
|
|
jsonData:
|
|
maxLines: ENC[AES256_GCM,data:oVIHOg==,iv:0Pqr6QHMuChLx0fW3BDo6F4DjD+Db8KfaRG0d5FVpiM=,tag:p9R7APLX6jrqlpfziFe1jg==,type:int]
|
|
ingress:
|
|
enabled: true
|
|
ingressClassName: traefik
|
|
annotations:
|
|
external-dns.alpha.kubernetes.io/enabled: "true"
|
|
hosts:
|
|
- grafana.lan
|
|
path: /
|
|
pathType: Prefix
|
|
tls: []
|
|
# ---------------------------------------------------------------------------
|
|
# vmalert — evaluates VMRule CRs against VictoriaMetrics, forwards firing
|
|
# alerts to Alertmanager. selectAllByDefault picks up all VMRules in the
|
|
# namespace (including our vmalert-rules.yaml VMRule CR).
|
|
# ---------------------------------------------------------------------------
|
|
vmalert:
|
|
enabled: true
|
|
spec:
|
|
selectAllByDefault: true
|
|
evaluationInterval: 20s
|
|
notifiers:
|
|
- url: http://vm-victoria-metrics-k8s-stack-alertmanager.observability.svc.cluster.local:9093
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 128Mi
|
|
# ---------------------------------------------------------------------------
|
|
# Alertmanager — 1 replica; inline config with a single n8n webhook receiver.
|
|
# n8n runs on the docker host and fans out to email/Telegram/whatever.
|
|
# ---------------------------------------------------------------------------
|
|
alertmanager:
|
|
enabled: true
|
|
spec:
|
|
replicaCount: 1
|
|
port: "9093"
|
|
selectAllByDefault: true
|
|
storage:
|
|
volumeClaimTemplate:
|
|
spec:
|
|
storageClassName: longhorn
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
resources:
|
|
requests:
|
|
storage: 2Gi
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 128Mi
|
|
config:
|
|
route:
|
|
receiver: n8n-webhook
|
|
group_wait: 30s
|
|
group_interval: 5m
|
|
repeat_interval: 4h
|
|
receivers:
|
|
- name: n8n-webhook
|
|
webhook_configs:
|
|
- url: http://n8n.lan/webhook/observability-alert
|
|
send_resolved: true
|
|
extraRules:
|
|
node-alerts:
|
|
groups:
|
|
- name: node
|
|
rules:
|
|
- alert: HighNodeCPU
|
|
expr: 100 - (avg by (instance) (rate(node_cpu_seconds_total{mode="idle"}[5m])) * 100) > 80
|
|
for: 10m
|
|
labels:
|
|
severity: warning
|
|
annotations:
|
|
summary: High CPU on {{ $labels.instance }}
|
|
description: CPU usage above 80% for 10 minutes.
|
|
- alert: HighNodeRAM
|
|
expr: 100 - ((node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes) * 100) > 85
|
|
for: 10m
|
|
labels:
|
|
severity: warning
|
|
annotations:
|
|
summary: High RAM on {{ $labels.instance }}
|
|
description: RAM usage above 85% for 10 minutes.
|
|
- alert: LowDiskSpace
|
|
expr: |
|
|
100 - ((node_filesystem_avail_bytes{mountpoint!~"/run.*|/var/lib/docker.*"} /
|
|
node_filesystem_size_bytes{mountpoint!~"/run.*|/var/lib/docker.*"}) * 100) > 85
|
|
for: 10m
|
|
labels:
|
|
severity: warning
|
|
annotations:
|
|
summary: Low disk space on {{ $labels.instance }} {{ $labels.mountpoint }}
|
|
description: Disk usage above 85% for 10 minutes.
|
|
sops:
|
|
lastmodified: "2026-08-26T19:28:04Z"
|
|
mac: ENC[AES256_GCM,data:duINkuCjZUjD8uoC38wXH7j3QbFLw1fM9R4BA5ZDSsR+yh/YU463co5RbqSMOWNz3vzLAvwrx5oIT+mkFvq9WlhqDFBNqTRaSZUtXeBrX9DDng83fG2lRn91HmcnjcdNsq+JuPL/tITvWOZj4B35SCMU4qDN/RNRZ7lLN8aM4Qg=,iv:oH+WXVyya0+UPzZp65EShapOwVKylP23oSl8o8BQSFU=,tag:HVY3fh22qjyHDrnTyf2dHg==,type:str]
|
|
pgp:
|
|
- created_at: "2026-08-26T19:28:04Z"
|
|
enc: |-
|
|
-----BEGIN PGP MESSAGE-----
|
|
|
|
hQIMA7uy4qQr71wiARAAnQ8Ybjm7BCJ8yF5dQXsGRNcz62xxLl0hZy09Ovmp8ofD
|
|
rUpypx85jEbqVSuBK2dXaDrFNnF47Pk5PG1J1XK74K6CZh54SbtDBDmkfi2wXJBN
|
|
GPZB0dE5g9H6BQwhuv5KpiuwGYHWHpOPeauYImfEoLoVzO9hw7kawDQLGWylSf3Z
|
|
JpXFSdSMXW/Q3OVcmnN6e7KumceOzmwjbCK5aDoBHEMX8PrG23rGaBe1Y4dMuZT8
|
|
5dDVO5vaS1SYC81Piak7ekWTeEP6Lw+kGUdJyrHqyCzrSeGxWisBcqZkbSqSgKqQ
|
|
OllJ2aPwTA6PUNp3P5aTZBkflS4aKGF92gmIAZSsWDcqu31O5gWJ4+aBHzb8KbRX
|
|
7eMY8oLy5YFndX3zD2dBpLomtGXNxXwD+R2QRMR5hS+CAVEGPm7nF0N5o624OG19
|
|
vNUNHxaSLoKamhlgPPky0PxqArNrXfZ0p4Cvm8hj9zAMDex9vggXb7f1YE/aXGyc
|
|
iul3yMEb6Dk/n/91GAE62SsojHer1UyE5JptRdLDrkBiVLoAeV91LZHjqUSDe61q
|
|
8K6zrZL1wj0fJz+EljExhN2ZfDk+c+UKe2vTm39HDGltDjNbCnFUAUDsYmn7lcf+
|
|
cKEYliPFfyG+WJfwk33+2Pa8t0AITCBf4D9XFQyjmUJDsVDH07AjUjxl09Za54fS
|
|
XAFWX2hR+jYN5S2JM07HLwtlyr3/K3I8dlGrNwvqXomFof/U/EBA3e94FKHt5Rnn
|
|
9uM9de/8j6L18A6hI6FI1P58pcAzO2y67JegarsDgiGqcDnvtNghOzBKRWMP
|
|
=Oel8
|
|
-----END PGP MESSAGE-----
|
|
fp: DC6910268E657FF70BA7EC289974494E76938DDC
|
|
encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
|
|
mac_only_encrypted: true
|
|
version: 3.10.2
|