Skip to content

Commit ce0f811

Browse files
YuryHrytsukYuryHrytsuk
committed
Kubernetes: add monitoring (victoria metrics)
1 parent d9321b2 commit ce0f811

File tree

10 files changed

+275
-1
lines changed

10 files changed

+275
-1
lines changed

‎charts/calico-configuration/templates/globalpolicy.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ spec:
88
# "calico-system", "calico-apiserver", "tigera-operator" -- calico namespaces (when installed via scripts [local deployment])
99
# TODO: other namespaces are to be removed from this list (once appropriate network policies are created)
1010
namespaceSelector:
11-
kubernetes.io/metadata.name not in {"kube-public", "kube-system", "kube-node-lease", "calico-system", "calico-apiserver", "tigera-operator", "reflector", "traefik", "victoria-logs", "csi-s3", "portainer", "topolvm", "local-path-storage", "longhorn"}
11+
kubernetes.io/metadata.name not in {"kube-public", "kube-system", "kube-node-lease", "calico-system", "calico-apiserver", "tigera-operator", "reflector", "traefik", "victoria-logs", "csi-s3", "portainer", "topolvm", "local-path-storage", "longhorn", "victoria-metrics-operator"}
1212
types:
1313
- Ingress
1414
- Egress

‎charts/victoria-metrics-k8s-stack/namespace.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# namespace with defined pod security standard
2+
# inspired from https://aro-labs.com/pod-security-standards/
3+
# official doc: https://kubernetes.io/docs/concepts/security/pod-security-standards/
4+
#
5+
# Warning: if pod / container does not meet enforced standards, it will not be deployed (silently)
6+
# execute `kubectl -n <namespace> events` to see errors (e.g.)
7+
# Error creating: pods "xyz" is forbidden: violates PodSecurity "baseline:latest": privileged
8+
# container "xyz" must not set securityContext.privileged to true
9+
#
10+
apiVersion: v1
11+
kind: Namespace
12+
metadata:
13+
name: monitoring
14+
labels:
15+
pod-security.kubernetes.io/enforce: restricted

‎charts/victoria-metrics-k8s-stack/values.yaml.gotmpl‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
vmsingle:
2+
# values documented here https://docs.victoriametrics.com/operator/api/#vmsingle
3+
spec:
4+
replicaCount: 2
5+
port: "8428" # must be string or field validation fails
6+
useStrictSecurity: true
7+
8+
# podSecurityContext: &restrictedPodSecurityContext
9+
# enabled: true
10+
# runAsNonRoot: true
11+
# runAsUser: 1000
12+
# privileged: false
13+
14+
securityContext: &restrictedSecurityContext
15+
enabled: true
16+
capabilities:
17+
drop: ["ALL"]
18+
readOnlyRootFilesystem: true
19+
allowPrivilegeEscalation: false
20+
seccompProfile:
21+
type: RuntimeDefault
22+
23+
topologySpreadConstraints:
24+
- maxSkew: 1
25+
topologyKey: "kubernetes.io/hostname"
26+
whenUnsatisfiable: DoNotSchedule
27+
# hardcoded due to https://github.com/VictoriaMetrics/helm-charts/issues/2219
28+
labelSelector:
29+
matchLabels:
30+
app: server
31+
app.kubernetes.io/instance: victoria-metrics
32+
app.kubernetes.io/name: victoria-metrics-k8s-stack
33+
# we manage operator and crds in separate chart
34+
# it is easier to delete victoria metrics charts
35+
# separately this way
36+
victoria-metrics-operator:
37+
enabled: false
38+
39+
alertmanager:
40+
enabled: false
41+
42+
vmagent:
43+
enabled: false
44+
45+
vmalert:
46+
enabled: false
47+
48+
grafana:
49+
enabled: false
50+
51+
prometheus-node-exporter:
52+
enabled: false
53+
54+
kube-state-metrics:
55+
enabled: false
56+
57+
kubelet:
58+
enabled: false
59+
60+
kubeApiServer:
61+
enabled: false
62+
63+
kubeControllerManager:
64+
enabled: false
65+
66+
coreDns:
67+
# -- Enabled CoreDNS metrics scraping
68+
enabled: false
69+
70+
kubeEtcd:
71+
enabled: false
72+
73+
kubeScheduler:
74+
# -- Enable KubeScheduler metrics scraping
75+
enabled: false
76+
77+
defaultDashboards:
78+
# -- Enable custom dashboards installation
79+
enabled: false
80+
81+
defaultRules:
82+
# -- Enable custom alerting rules installation
83+
create: false

‎charts/victoria-metrics-operator/namespace.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# namespace with defined pod security standard
2+
# inspired from https://aro-labs.com/pod-security-standards/
3+
# official doc: https://kubernetes.io/docs/concepts/security/pod-security-standards/
4+
#
5+
# Warning: if pod / container does not meet enforced standards, it will not be deployed (silently)
6+
# execute `kubectl -n <namespace> events` to see errors (e.g.)
7+
# Error creating: pods "xyz" is forbidden: violates PodSecurity "baseline:latest": privileged
8+
# container "xyz" must not set securityContext.privileged to true
9+
#
10+
apiVersion: v1
11+
kind: Namespace
12+
metadata:
13+
name: victoria-metrics-operator
14+
labels:
15+
pod-security.kubernetes.io/enforce: restricted

‎charts/victoria-metrics-operator/values.yaml.gotmpl‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
securityContext:
2+
seccompProfile:
3+
type: RuntimeDefault
4+
5+
admissionWebhooks:
6+
certManager:
7+
# avoid new cert generation on every helm run
8+
enabled: true

‎charts/victoria-metrics-stack/Chart.lock‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
dependencies:
2+
- name: victoria-metrics-single
3+
repository: https://victoriametrics.github.io/helm-charts/
4+
version: 0.25.2
5+
- name: victoria-metrics-agent
6+
repository: https://victoriametrics.github.io/helm-charts/
7+
version: 0.26.2
8+
digest: sha256:e9a8c4ed4495ecfcf9962a6aa7fc9f6a6e8813e69a20daa9bb38b2d9a018c50e
9+
generated: "2025-10-26T12:42:21.158234622+01:00"

‎charts/victoria-metrics-stack/Chart.yaml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
apiVersion: v2
2+
name: victoria-metrics-stack
3+
description: A Helm chart for Kubernetes
4+
5+
# A chart can be either an 'application' or a 'library' chart.
6+
#
7+
# Application charts are a collection of templates that can be packaged into versioned archives
8+
# to be deployed.
9+
#
10+
# Library charts provide useful utilities or functions for the chart developer. They're included as
11+
# a dependency of application charts to inject those utilities and functions into the rendering
12+
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
13+
type: application
14+
15+
# This is the chart version. This version number should be incremented each time you make changes
16+
# to the chart and its templates, including the app version.
17+
# Versions are expected to follow Semantic Versioning (https://semver.org/)
18+
version: 0.1.0
19+
20+
# This is the version number of the application being deployed. This version number should be
21+
# incremented each time you make changes to the application. Versions are not expected to
22+
# follow Semantic Versioning. They should reflect the version the application is using.
23+
# It is recommended to use it with quotes.
24+
appVersion: "1.128.0"
25+
26+
dependencies:
27+
- name: victoria-metrics-single
28+
version: 0.25.2
29+
repository: &victoria-metrics-repo "https://victoriametrics.github.io/helm-charts/"
30+
condition: victoria-metrics-single.enabled
31+
32+
# - name: victoria-metrics-auth
33+
# version: 0.19.7
34+
# repository: *victoria-metrics-repo
35+
36+
- name: victoria-metrics-agent
37+
version: 0.26.2
38+
repository: *victoria-metrics-repo
39+
condition: victoria-metrics-agent.enabled

‎charts/victoria-metrics-stack/namespace.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# namespace with defined pod security standard
2+
# inspired from https://aro-labs.com/pod-security-standards/
3+
# official doc: https://kubernetes.io/docs/concepts/security/pod-security-standards/
4+
#
5+
# Warning: if pod / container does not meet enforced standards, it will not be deployed (silently)
6+
# execute `kubectl -n <namespace> events` to see errors (e.g.)
7+
# Error creating: pods "xyz" is forbidden: violates PodSecurity "baseline:latest": privileged
8+
# container "xyz" must not set securityContext.privileged to true
9+
#
10+
apiVersion: v1
11+
kind: Namespace
12+
metadata:
13+
name: monitoring
14+
labels:
15+
pod-security.kubernetes.io/enforce: restricted

‎charts/victoria-metrics-stack/templates/networkpolicies.yaml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
apiVersion: projectcalico.org/v3
2+
kind: NetworkPolicy
3+
metadata:
4+
name: vm-server-network-policy
5+
spec:
6+
selector: >-
7+
app.kubernetes.io/name == "victoria-metrics-single"
8+
&& app.kubernetes.io/instance == "{{ .Release.Name }}"
9+
ingress:
10+
- action: Allow
11+
protocol: TCP
12+
destination:
13+
ports:
14+
- {{ index .Values "victoria-metrics-single" "server" "service" "servicePort" }}
15+
16+
---
17+
18+
apiVersion: projectcalico.org/v3
19+
kind: NetworkPolicy
20+
metadata:
21+
name: vm-agent-network-policy
22+
spec:
23+
selector: >-
24+
app.kubernetes.io/name == "victoria-metrics-agent"
25+
&& app.kubernetes.io/instance == "{{ .Release.Name }}"
26+
egress:
27+
- action: Allow
28+
protocol: TCP
29+
destination:
30+
nets:
31+
- 10.0.0.0/8
32+
- 172.16.0.0/12
33+
- 192.168.0.0/16
34+
ports:
35+
- 6443
36+
- action: Allow
37+
protocol: TCP
38+
destination:
39+
ports:
40+
- {{ index .Values "victoria-metrics-single" "server" "service" "servicePort" }}

‎charts/victoria-metrics-stack/values.yaml.gotmpl‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
victoria-metrics-single:
2+
enabled: true
3+
4+
server:
5+
replicaCount: 2
6+
7+
service:
8+
servicePort: 8428
9+
10+
mode: statefulSet
11+
12+
# avoid name to long (>63 char) error
13+
fullnameOverride: vm-server
14+
15+
podSecurityContext: &restrictedPodSecurityContext
16+
enabled: true
17+
runAsNonRoot: true
18+
runAsUser: 1000
19+
privileged: false
20+
21+
securityContext: &restrictedSecurityContext
22+
enabled: true
23+
capabilities:
24+
drop: ["ALL"]
25+
readOnlyRootFilesystem: true
26+
allowPrivilegeEscalation: false
27+
seccompProfile:
28+
type: RuntimeDefault
29+
30+
victoria-metrics-agent:
31+
enabled: true
32+
fullnameOverride: vm-agent
33+
34+
config:
35+
global:
36+
scrape_interval: 20s
37+
38+
service:
39+
enabled: true
40+
servicePort: 8429
41+
42+
remoteWrite:
43+
- url: "http://vm-server-0.vm-server.{{ .Release.Namespace }}.svc.cluster.local:8428/api/v1/write"
44+
- url: "http://vm-server-1.vm-server.{{ .Release.Namespace }}.svc.cluster.local:8428/api/v1/write"
45+
46+
podSecurityContext: *restrictedPodSecurityContext
47+
securityContext: *restrictedSecurityContext
48+
49+
50+
victoria-metrics-auth:

0 commit comments

Comments
 (0)