Deploy monitoring stack

cluster/applications/monitoring/application.yaml

@@ -0,0 +1,39 @@
+# ------------------------------------------------------------------------------
+# Application: monitoring (kube-prometheus-stack)
+# Wave 10 — first application workload, after all platform services
+# Multi-source: Helm chart from upstream + values + HTTPRoute from repo
+# ------------------------------------------------------------------------------
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: monitoring
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "10"
+spec:
+  project: default
+  sources:
+    # Source 1: Helm chart from upstream
+    - repoURL: https://prometheus-community.github.io/helm-charts
+      chart: kube-prometheus-stack
+      targetRevision: 70.4.2
+      helm:
+        valueFiles:
+          - $values/cluster/applications/monitoring/values.yaml
+    # Source 2: Repo — values ref + HTTPRoute
+    - repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
+      targetRevision: main
+      path: cluster/applications/monitoring
+      ref: values
+      directory:
+        exclude: "application.yaml"
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: monitoring
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

cluster/applications/monitoring/externalsecret.yaml

@@ -0,0 +1,27 @@
+# ------------------------------------------------------------------------------
+# ExternalSecret — Grafana admin credentials
+# 1Password item: "grafana-admin" in the "mk-labs" vault
+# Fields: admin-user, admin-password
+# ------------------------------------------------------------------------------
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: grafana-admin-secret
+  namespace: monitoring
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-connect
+  refreshInterval: "1h"
+  target:
+    name: grafana-admin-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: admin-user
+      remoteRef:
+        key: grafana-admin
+        property: admin-user
+    - secretKey: admin-password
+      remoteRef:
+        key: grafana-admin
+        property: admin-password

cluster/applications/monitoring/httproute.yaml

@@ -0,0 +1,36 @@
+# ------------------------------------------------------------------------------
+# HTTPRoute — Grafana via Cilium Gateway
+# Cert issued per-service via cert-manager annotation on the Certificate
+# ------------------------------------------------------------------------------
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: grafana-tls
+  namespace: monitoring
+spec:
+  secretName: grafana-tls
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+    - grafana.local.mk-labs.cloud
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: grafana
+  namespace: monitoring
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: grafana.local.mk-labs.cloud
+    external-dns.alpha.kubernetes.io/target: "10.1.71.90"
+spec:
+  parentRefs:
+    - name: fastpass-gateway
+      namespace: gateway
+      sectionName: https
+  hostnames:
+    - grafana.local.mk-labs.cloud
+  rules:
+    - backendRefs:
+        - name: monitoring-grafana
+          port: 80

cluster/applications/monitoring/values.yaml

@@ -0,0 +1,170 @@
+# ------------------------------------------------------------------------------
+# kube-prometheus-stack — Helm Values
+# Chart: https://prometheus-community.github.io/helm-charts
+# Version: 70.4.2
+# ------------------------------------------------------------------------------
+
+# ─── Global ───────────────────────────────────────────────────────────────────
+fullnameOverride: ""
+
+# ─── Alertmanager ─────────────────────────────────────────────────────────────
+# Deployed but unconfigured — wire into n8n later
+alertmanager:
+  enabled: true
+  alertmanagerSpec:
+    storage:
+      volumeClaimTemplate:
+        spec:
+          storageClassName: nfs-emporium
+          accessModes:
+            - ReadWriteOnce
+          resources:
+            requests:
+              storage: 5Gi
+
+# ─── Prometheus ───────────────────────────────────────────────────────────────
+prometheus:
+  prometheusSpec:
+    # Retention
+    retention: 30d
+    retentionSize: "45GB"
+
+    # Storage — NFS via csi-driver-nfs
+    storageSpec:
+      volumeClaimTemplate:
+        spec:
+          storageClassName: nfs-emporium
+          accessModes:
+            - ReadWriteOnce
+          resources:
+            requests:
+              storage: 50Gi
+
+    # Scrape all ServiceMonitors and PodMonitors regardless of namespace
+    serviceMonitorSelectorNilUsesHelmValues: false
+    podMonitorSelectorNilUsesHelmValues: false
+    ruleSelectorNilUsesHelmValues: false
+
+    # Resource limits — fastpass workers have reasonable headroom
+    resources:
+      requests:
+        cpu: 200m
+        memory: 512Mi
+      limits:
+        cpu: 1000m
+        memory: 2Gi
+
+# ─── Grafana ──────────────────────────────────────────────────────────────────
+grafana:
+  enabled: true
+
+  # Stateless — dashboards managed as ConfigMaps, no PVC needed
+  persistence:
+    enabled: false
+
+  # Admin credentials via ESO from 1Password
+  admin:
+    existingSecret: grafana-admin-secret
+    userKey: admin-user
+    passwordKey: admin-password
+
+  # Grafana URL — used for redirects and OAuth callbacks
+  grafana.ini:
+    server:
+      root_url: https://grafana.local.mk-labs.cloud
+    auth:
+      disable_login_form: false
+
+  # Default dashboards
+  defaultDashboardsEnabled: true
+  defaultDashboardsTimezone: browser
+
+  # Node Exporter Full — dashboard 1860
+  dashboardProviders:
+    dashboardproviders.yaml:
+      apiVersion: 1
+      providers:
+        - name: default
+          orgId: 1
+          folder: ""
+          type: file
+          disableDeletion: false
+          editable: true
+          options:
+            path: /var/lib/grafana/dashboards/default
+
+  dashboards:
+    default:
+      node-exporter-full:
+        gnetId: 1860
+        revision: 37
+        datasource: Prometheus
+      kubernetes-cluster:
+        gnetId: 7249
+        revision: 1
+        datasource: Prometheus
+      kubernetes-pods:
+        gnetId: 6336
+        revision: 1
+        datasource: Prometheus
+
+  # Sidecar for ConfigMap-based dashboards
+  sidecar:
+    dashboards:
+      enabled: true
+      searchNamespace: ALL
+      label: grafana_dashboard
+      labelValue: "1"
+
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      cpu: 500m
+      memory: 512Mi
+
+# ─── Node Exporter ────────────────────────────────────────────────────────────
+nodeExporter:
+  enabled: true
+
+prometheus-node-exporter:
+  tolerations:
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
+
+# ─── kube-state-metrics ───────────────────────────────────────────────────────
+kubeStateMetrics:
+  enabled: true
+
+# ─── Prometheus Operator ──────────────────────────────────────────────────────
+prometheusOperator:
+  enabled: true
+
+# ─── Component scraping ───────────────────────────────────────────────────────
+kubeApiServer:
+  enabled: true
+
+kubelet:
+  enabled: true
+
+kubeControllerManager:
+  enabled: true
+
+kubeScheduler:
+  enabled: true
+
+kubeProxy:
+  enabled: false  # Cilium replaces kube-proxy
+
+kubeEtcd:
+  enabled: true
+  endpoints:
+    - 10.1.71.66
+    - 10.1.71.67
+    - 10.1.71.68
+  service:
+    enabled: true
+    port: 2381
+    targetPort: 2381