# values-service-cluster.yaml
# kube-prometheus-stack for SERVICE cluster
# ============================================
# PROMETHEUS - optional, for local service cluster metrics
# ============================================
prometheus:
prometheusSpec:
externalLabels:
cluster: "service-cluster"
# Also push to local Thanos Receive (so all metrics go through same path)
remoteWrite:
- url: http://thanos-receive.monitoring.svc:19291/api/v1/receive
retention: 24h
resources:
requests:
cpu: 200m
memory: 512Mi
limits:
memory: 2Gi
# ============================================
# ALERTMANAGER - central instance
# ============================================
alertmanager:
enabled: true
# Expose via MetalLB so site clusters can reach it
service:
type: LoadBalancer
annotations:
metallb.universe.tf/loadBalancerIPs: 10.x.x.51
alertmanagerSpec:
replicas: 2
retention: 120h
storage:
volumeClaimTemplate:
spec:
accessModes: ["ReadWriteOnce"]
resources:
requests:
storage: 10Gi
resources:
requests:
cpu: 100m
memory: 256Mi
config:
global:
resolve_timeout: 5m
route:
receiver: 'default'
group_by: ['alertname', 'cluster'] # Group by cluster!
group_wait: 30s
group_interval: 5m
repeat_interval: 4h
routes:
- match:
severity: critical
receiver: 'critical'
receivers:
- name: 'default'
# Configure your receivers (Slack, email, etc.)
# slack_configs:
# - channel: '#alerts'
# api_url: 'https://hooks.slack.com/...'
- name: 'critical'
# pagerduty_configs:
# - service_key: '<key>'
# ============================================
# GRAFANA - central with SSO
# ============================================
grafana:
enabled: true
replicas: 1
# Persistence for dashboards
persistence:
enabled: true
size: 5Gi
# Keycloak OIDC
grafana.ini:
server:
root_url: https://grafana.example.com
auth:
disable_login_form: false # Set true after SSO works
auth.generic_oauth:
enabled: true
name: Keycloak
allow_sign_up: true
client_id: grafana
client_secret: ${GRAFANA_OAUTH_SECRET}
scopes: openid profile email groups
auth_url: https://keycloak.example.com/realms/master/protocol/openid-connect/auth
token_url: https://keycloak.example.com/realms/master/protocol/openid-connect/token
api_url: https://keycloak.example.com/realms/master/protocol/openid-connect/userinfo
role_attribute_path: contains(groups[*], 'grafana-admin') && 'Admin' || contains(groups[*], 'grafana-editor') && 'Editor' || 'Viewer'
envFromSecret: grafana-oauth-secret
# Thanos Query as datasource (added automatically via additionalDataSources)
additionalDataSources:
- name: Thanos
type: prometheus
url: http://thanos-query.monitoring.svc:9090
access: proxy
isDefault: true
resources:
requests:
cpu: 100m
memory: 256Mi
# ============================================
# EXPORTERS
# ============================================
nodeExporter:
enabled: true
kubeStateMetrics:
enabled: true
# ============================================
# DEFAULT RULES
# ============================================
defaultRules:
create: true
Comments
0 B
|👍
/👎
0 B
|👍
/👎
0 B
|👍
/👎
0 B
|👍
/👎
0 B
|👍
/👎
0 B
|👍
/👎
0 B
|👍
/👎
0 B
|👍
/👎
0 B
|👍
/👎
0 B
|👍
/👎
0 B
|👍
/👎
0 B
|👍
/👎