create monitoring set

clusters/cl01tl/monitoring/grafana/Chart.yaml

@@ -0,0 +1,21 @@
+apiVersion: v2
+name: grafana
+version: 1.0.0
+description: Grafana
+keywords:
+  - grafana
+  - dashboard
+  - metrics
+  - logs
+home: ""
+sources:
+  - https://github.com/grafana/grafana
+  - https://github.com/grafana/helm-charts/tree/main/charts/grafana
+maintainers:
+  - name: alexlebens
+dependencies:
+  - name: grafana
+    version: 8.0.2
+    repository: https://grafana.github.io/helm-charts
+icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/grafana.png
+appVersion: 10.4.0

clusters/cl01tl/monitoring/grafana/templates/external-secret.yaml

@@ -0,0 +1,62 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: grafana-auth-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: admin-user
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/grafana/auth
+        metadataPolicy: None
+        property: admin-user
+    - secretKey: admin-password
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /cl01tl/grafana/auth
+        metadataPolicy: None
+        property: admin-password
+
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: grafana-oauth-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: GF_AUTH_GENERIC_OAUTH_CLIENT_ID
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /authentik/oidc/grafana
+        metadataPolicy: None
+        property: client
+    - secretKey: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /authentik/oidc/grafana
+        metadataPolicy: None
+        property: secret

clusters/cl01tl/monitoring/grafana/values.yaml

@@ -0,0 +1,142 @@
+grafana:
+  deploymentStrategy:
+    type: Recreate
+  createConfigmap: true
+  serviceMonitor:
+    enabled: true
+  ingress:
+    enabled: true
+    ingressClassName: traefik
+    annotations:
+      traefik.ingress.kubernetes.io/router.entrypoints: websecure
+      traefik.ingress.kubernetes.io/router.tls: "true"
+      cert-manager.io/cluster-issuer: letsencrypt-issuer
+    hosts:
+      - grafana.alexlebens.net
+    tls:
+      - secretName: grafana-secret-tls
+        hosts:
+          - grafana.alexlebens.net
+  persistence:
+    enabled: true
+    storageClassName: ceph-block
+  admin:
+    existingSecret: grafana-auth-secret
+    userKey: admin-user
+    passwordKey: admin-password
+  envFromSecret: grafana-oauth-secret
+  plugins:
+    - grafana-clock-panel
+    - vonage-status-panel
+    - grafana-worldmap-panel
+  datasources:
+    datasources.yaml:
+      apiVersion: 1
+      datasources:
+        - name: Prometheus
+          type: prometheus
+          uid: prometheus
+          url: http://kube-prometheus-stack-prometheus.kube-prometheus-stack:9090/
+          access: proxy
+          isDefault: true
+          jsonData:
+            timeInterval: 30s
+        - name: Loki
+          type: loki
+          url: http://loki.loki:3100
+          jsonData:
+            httpHeaderName1: "X-Scope-OrgID"
+          secureJsonData:
+            httpHeaderValue1: "1"
+  dashboardProviders:
+    dashboardproviders.yaml:
+      apiVersion: 1
+      providers:
+        - name: "default"
+          orgId: 1
+          folder: ""
+          type: file
+          disableDeletion: false
+          editable: true
+          options:
+            path: /var/lib/grafana/dashboards/default
+  dashboards:
+    default:
+      node-exporter:
+        gnetId: 1860
+        revision: 33
+        datasource: Prometheus
+      coredns:
+        gnetId: 14981
+        revision: 2
+        datasource: Prometheus
+      loki:
+        gnetId: 14055
+        revision: 5
+        datasource: Prometheus
+      argocd:
+        gnetId: 14584
+        revision: 1
+        datasource: Prometheus
+      cert-manager:
+        gnetId: 11001
+        revision: 1
+        datasource: Prometheus
+      traefik:
+        gnetId: 17346
+        revision: 7
+        datasource: Prometheus
+      kubernetes-nodes:
+        gnetId: 8171
+        revision: 1
+        datasource: Prometheus
+      vault:
+        gnetId: 12904
+        revision: 2
+        datasource: Prometheus
+      ceph:
+        gnetId: 2842
+        revision: 17
+        datasource: Prometheus
+      alertmanager:
+        gnetId: 9578
+        revision: 4
+        datasource: Prometheus
+      sonarr:
+        gnetId: 12530
+        revision: 2
+        datasource: Prometheus
+      radarr:
+        gnetId: 12896
+        revision: 1
+        datasource: Prometheus
+      unpoller:
+        gnetId: 11315
+        revision: 9
+        datasource: Prometheus
+      etcd:
+        gnetId: 3070
+        revision: 3
+        datasource: Prometheus
+  grafana.ini:
+    analytics:
+      check_for_updates: false
+    server:
+      domain: alexlebens.net
+      root_url: https://grafana.alexlebens.net
+    users:
+      auto_assign_org: true
+      auto_assign_org_id: 1
+    auth:
+      disable_login_form: true
+      oauth_auto_login: true
+      signout_redirect_url: https://authentik.alexlebens.net/application/o/grafana/end-session/
+    auth.generic_oauth:
+      enabled: true
+      name: Authentik
+      allow_sign_up: true
+      scopes: openid profile email
+      auth_url: https://authentik.alexlebens.net/application/o/authorize/
+      token_url: https://authentik.alexlebens.net/application/o/token/
+      api_url: https://authentik.alexlebens.net/application/o/userinfo/
+      role_attribute_path: contains(groups, 'Grafana Admins') && 'Admin' || contains(groups, 'Grafana Editors') && 'Editor' || 'Viewer'

clusters/cl01tl/monitoring/kube-prometheus-stack/Chart.yaml

@@ -0,0 +1,23 @@
+apiVersion: v2
+name: kube-prometheus-stack
+version: 1.0.0
+description: Kube Prometheus Stack
+keywords:
+  - kube-prometheus-stack
+  - prometheus
+  - alertmanager
+  - metrics
+  - alerts
+  - kubernetes
+home: ""
+sources:
+  - https://github.com/prometheus/prometheus
+  - https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack
+maintainers:
+  - name: alexlebens
+dependencies:
+  - name: kube-prometheus-stack
+    version: 60.4.0
+    repository: https://prometheus-community.github.io/helm-charts
+icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/prometheus.png
+appVersion: v0.74.0

clusters/cl01tl/monitoring/kube-prometheus-stack/templates/external-secret.yaml

@@ -0,0 +1,37 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: alertmanager-config-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: discord_webhook
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /discord/alertmanager
+        metadataPolicy: None
+        property: webhook
+    - secretKey: pushover_token
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /pushover/key
+        metadataPolicy: None
+        property: alertmanager_key
+    - secretKey: user_key
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /pushover/key
+        metadataPolicy: None
+        property: user_key

clusters/cl01tl/monitoring/kube-prometheus-stack/values.yaml

@@ -0,0 +1,143 @@
+kube-prometheus-stack:
+  crds:
+    enabled: false
+  defaultRules:
+    create: true
+    rules:
+      kubeControllerManager: false
+      kubeSchedulerAlerting: false
+      kubeSchedulerRecording: false
+  global:
+    rbac:
+      create: true
+      createAggregateClusterRoles: true
+  alertmanager:
+    enabled: true
+    config:
+      route:
+        group_by: ["namespace","alertname"]
+        group_wait: 30s
+        group_interval: 5m
+        repeat_interval: 24h
+        receiver: discord
+        routes:
+          - receiver: "null"
+            matchers:
+              - alertname = "Watchdog"
+          - receiver: 'pushover'
+            group_wait: 10s
+            group_interval: 5m
+            repeat_interval: 24h
+            matchers:
+              - severity = "critical"
+      receivers:
+        - name: "null"
+        - name: discord
+          discord_configs:
+            - send_resolved: true
+              webhook_url: https://discord.com/api/webhooks/1215465356315983922/CSaWG3SygslTNQo0uw07FB-0eKGl9nw2kDAqbAfH7JMe1ExVin8UvjlP4qkJoEyjDawz
+        - name: pushover
+          pushover_configs:
+            - send_resolved: true
+              user_key_file: /etc/alertmanager/secrets/alertmanager-config-secret/user_key
+              token_file: /etc/alertmanager/secrets/alertmanager-config-secret/pushover_token
+    ingress:
+      enabled: true
+      ingressClassName: traefik
+      annotations:
+        traefik.ingress.kubernetes.io/router.entrypoints: websecure
+        traefik.ingress.kubernetes.io/router.tls: "true"
+        cert-manager.io/cluster-issuer: letsencrypt-issuer
+      hosts:
+        - alertmanager.alexlebens.net
+      tls:
+        - secretName: alertmanager-secret-tls
+          hosts:
+            - alertmanager.alexlebens.net
+    alertmanagerSpec:
+      secrets:
+        - alertmanager-config-secret
+      replicas: 1
+    externalUrl: https://alertmanager.alexlebens.net
+  grafana:
+    enabled: false
+  kubeApiServer:
+    tlsConfig:
+      insecureSkipVerify: true
+  kubeControllerManager:
+    enabled: false
+  kubeScheduler:
+    enabled: false
+  kubeProxy:
+    enabled: false
+  kube-state-metrics:
+    selfMonitor:
+      enabled: true
+  nodeExporter:
+    operatingSystems:
+      darwin:
+        enabled: false
+  prometheusOperator:
+    admissionWebhooks:
+      enabled: true
+    namespaces:
+      releaseNamespace: true
+      additional:
+        - kube-system
+        - argocd
+        - authentik
+        - cert-manager
+        - cloudnative-pg
+        - freshrss
+        - gitea
+        - grafana
+        - home-assistant
+        - kyoo
+        - lidarr2
+        - local-static-provisioner
+        - loki
+        - matrix-synapse
+        - outline
+        - penpot
+        - qbittorrent
+        - radarr5
+        - radarr5-4k
+        - readarr-books
+        - reloader
+        - rook-ceph
+        - sonarr4
+        - sonarr4-4k
+        - speedtest-exporter
+        - taiga
+        - tdarr
+        - unpoller
+        - vault
+        - vikunja
+  prometheus:
+    ingress:
+      enabled: true
+      ingressClassName: traefik
+      annotations:
+        traefik.ingress.kubernetes.io/router.entrypoints: websecure
+        traefik.ingress.kubernetes.io/router.tls: "true"
+        cert-manager.io/cluster-issuer: letsencrypt-issuer
+      hosts:
+        - prometheus.alexlebens.net
+      tls:
+        - secretName: prometheus-secret-tls
+          hosts:
+            - prometheus.alexlebens.net
+    prometheusSpec:
+      scrapeInterval: 30s
+      retention: 30d
+      externalUrl: https://prometheus.alexlebens.net
+      serviceMonitorSelectorNilUsesHelmValues: false
+      podMonitorSelectorNilUsesHelmValues: false
+      storageSpec:
+        volumeClaimTemplate:
+          spec:
+            storageClassName: ceph-block
+            accessModes: ["ReadWriteOnce"]
+            resources:
+              requests:
+                storage: 100Gi

clusters/cl01tl/monitoring/loki/Chart.yaml

@@ -0,0 +1,24 @@
+apiVersion: v2
+name: loki
+version: 1.0.0
+description: Loki
+keywords:
+  - loki
+  - promtail
+  - logs
+  - kubernetes
+home: ""
+sources:
+  - https://github.com/grafana/loki
+  - https://github.com/grafana/helm-charts
+maintainers:
+  - name: alexlebens
+dependencies:
+  - name: loki
+    version: 6.6.3
+    repository: https://grafana.github.io/helm-charts
+  - name: promtail
+    version: 6.16.0
+    repository: https://grafana.github.io/helm-charts
+icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/loki.png
+appVersion: 3.0.0

clusters/cl01tl/monitoring/loki/values.yaml

@@ -0,0 +1,49 @@
+loki:
+  deploymentMode: SingleBinary
+  loki:
+    auth_enabled: true
+    commonConfig:
+      replication_factor: 1
+    limits_config:
+      allow_structured_metadata: false
+    storage:
+      type: filesystem
+    schemaConfig:
+      configs:
+        - from: "2024-01-11"
+          store: boltdb-shipper
+          object_store: filesystem
+          schema: v13
+          index:
+            period: 24h
+  enterprise:
+    enabled: false
+  gateway:
+    enabled: true
+    basicAuth:
+      enabled: false
+  singleBinary:
+    replicas: 1
+    persistence:
+      enableStatefulSetAutoDeletePVC: true
+      enabled: true
+      size: 10Gi
+      storageClass: ceph-block
+  write:
+    replicas: 0
+  read:
+    replicas: 0
+  backend:
+    replicas: 0
+promtail:
+  service:
+    labels:
+      promtail: 3.0.0
+  serviceMonitor:
+    enabled: true
+    prometheusRule:
+      enabled: false
+  config:
+    clients:
+      - url: http://loki-gateway/loki/api/v1/push
+        tenant_id: 1

clusters/cl01tl/monitoring/unpoller/Chart.yaml

@@ -0,0 +1,23 @@
+apiVersion: v2
+name: unpoller
+version: 1.0.0
+description: Unpoller
+keywords:
+  - unpoller
+  - ubiquiti
+  - unifi
+  - metrics
+home: ""
+sources:
+  - https://github.com/unpoller/unpoller
+  - https://github.com/unpoller/unpoller/pkgs/container/unpoller
+  - https://github.com/bjw-s/helm-charts/blob/main/charts/other/app-template/values.yaml
+maintainers:
+  - name: alexlebens
+dependencies:
+  - name: app-template
+    alias: unpoller
+    repository: https://bjw-s.github.io/helm-charts/
+    version: 3.2.1
+icon: https://camo.githubusercontent.com/c5d07a5b3acfeac8e1c25bf56f440ffe032b86e4e7f15de82357f022a43fc927/68747470733a2f2f756e706f6c6c65722e636f6d2f696d672f6c6f676f2e706e67
+appVersion: v2.11.2

clusters/cl01tl/monitoring/unpoller/templates/external-secret.yaml

@@ -0,0 +1,30 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: unpoller-unifi-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: web
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: UP_UNIFI_CONTROLLER_0_USER
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /unifi/auth
+        metadataPolicy: None
+        property: user
+    - secretKey: UP_UNIFI_CONTROLLER_0_PASS
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /unifi/auth
+        metadataPolicy: None
+        property: password

clusters/cl01tl/monitoring/unpoller/templates/service-monitor.yaml

@@ -0,0 +1,21 @@
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: unpoller
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: unpoller
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+    app.kubernetes.io/component: metrics
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: unpoller
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  endpoints:
+    - port: metrics
+      interval: 30s
+      scrapeTimeout: 10s
+      path: /metrics

clusters/cl01tl/monitoring/unpoller/values.yaml

@@ -0,0 +1,57 @@
+unpoller:
+  controllers:
+    main:
+      type: deployment
+      replicas: 1
+      strategy: Recreate
+      revisionHistoryLimit: 3
+      containers:
+        main:
+          image:
+            repository: ghcr.io/unpoller/unpoller
+            tag: v2.11.2
+            pullPolicy: IfNotPresent
+          env:
+            - name: UP_UNIFI_CONTROLLER_0_SAVE_ALARMS
+              value: 'false'
+            - name: UP_UNIFI_CONTROLLER_0_SAVE_ANOMALIES
+              value: 'false'
+            - name: UP_UNIFI_CONTROLLER_0_SAVE_DPI
+              value: 'false'
+            - name: UP_UNIFI_CONTROLLER_0_SAVE_EVENTS
+              value: 'false'
+            - name: UP_UNIFI_CONTROLLER_0_SAVE_IDS
+              value: 'false'
+            - name: UP_UNIFI_CONTROLLER_0_SAVE_SITES
+              value: 'true'
+            - name: UP_UNIFI_CONTROLLER_0_URL
+              value: https://unifi.alexlebens.net/
+            - name: UP_UNIFI_CONTROLLER_0_VERIFY_SSL
+              value: 'false'
+            - name: UP_INFLUXDB_DISABLE
+              value: 'true'
+            - name: UP_PROMETHEUS_HTTP_LISTEN
+              value: 0.0.0.0:9130
+            - name: UP_PROMETHEUS_NAMESPACE
+              value: unpoller
+            - name: UP_POLLER_DEBUG
+              value: 'false'
+            - name: UP_POLLER_QUIET
+              value: 'false'
+          envFrom:
+            - secretRef:
+                name: unpoller-unifi-secret
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+  serviceAccount:
+    create: true
+  service:
+    main:
+      controller: main
+      ports:
+        metrics:
+          port: 9130
+          targetPort: 9130
+          protocol: TCP