prometheus-operator.gotmpl

{{- $v := .Values }}
{{- $apps := $v.apps }}
{{- $k := $apps.keycloak }}
{{- $o := $v | get "oidc" dict }}
{{- $a := $apps | get "alertmanager" }}
{{- $g := $apps | get "grafana" }}
{{- $p := $apps | get "prometheus" }}
{{- $pr := index $v.apps "policy-reporter" }}

{{- $hasKeycloak := $k.enabled }}
{{- $domain := ($v.cluster | get "domainSuffix" nil) }}
{{- $alertmanagerDomain := printf "alertmanager.%s" $domain }}
{{- $prometheusDomain := printf "prometheus.%s" $domain }}
{{- $grafanaDomain := printf "grafana.%s" $domain }}
{{- $slackTpl := tpl (readFile "../../helmfile.d/snippets/alertmanager/slack.gotmpl") $v | toString }}
{{- $opsgenieTpl := tpl (readFile "../../helmfile.d/snippets/alertmanager/opsgenie.gotmpl") $v | toString }}
{{- $grafanaIni := tpl (readFile "../../helmfile.d/snippets/grafana.gotmpl") (dict "keycloakBase" $v._derived.oidcBaseUrl "untrustedCA" $v._derived.untrustedCA "keycloak" ($k | get "idp")) | toString }}
{{- $httpRoute := tpl (readFile "../../helmfile.d/snippets/routes.gotmpl") $v | fromYaml }}
{{- $hasServices := false }}
{{- range $teamId, $team := $v.teamConfig }}
  {{- if gt (len ($team | get "services" list)) 0 }}{{ $hasServices = true }}{{ end }}
{{- end }}

{{- define "prometheus-operator.common-route-opts" }}
{{ with .annotations }}
annotations:
  {{ . | toYaml | nindent 2 }}
{{- end }}
parentRefs:
  {{- .parentRefs | toYaml | nindent 2 }}
additionalRules:
  {{- .authRules | toYaml | nindent 2 }}
{{- end }}

nameOverride: po
fullnameOverride: po
{{- with .Values.otomi | get "globalPullSecret" nil }}
global:
  imagePullSecrets:
    - name: otomi-pullsecret-global
{{- end }}

defaultRules:
  create: {{ $p.enabled }}
  disabled:
    {{- range $p.disabledRules }}
    {{ . }}: true
    {{- end }}
prometheusOperator:
  resources: {{- $p.resources.prometheusOperator | toYaml | nindent 4 }}
  {{- if $v.otomi.linodeLkeImageRepository }}
  image:
    registry: "{{- $v.otomi.linodeLkeImageRepository }}/quay"
  {{- end }}
  admissionWebhooks:
    enabled: true
    {{- if $v.otomi.linodeLkeImageRepository }}
    deployment:
      image:
        registry: "{{- $v.otomi.linodeLkeImageRepository }}/quay"
    patch:
      image:
        registry: "{{- $v.otomi.linodeLkeImageRepository }}/k8s"
    {{- end }}
    certManager:
      enabled: true
      issuerRef:
        name: custom-ca
        kind: ClusterIssuer
  priorityClassName: otomi-critical
  prometheusConfigReloader:
    resources: {{- $p.resources.prometheusConfigReloader | toYaml | nindent 6 }}
    {{- if $v.otomi.linodeLkeImageRepository }}
    image:
      registry: "{{- $v.otomi.linodeLkeImageRepository }}/quay"
    {{- end }}
commonLabels:
  prometheus: system
crds:
  enabled: false
prometheus:
  enabled: {{ $p.enabled }}
  prometheusSpec:
    {{- range $selType := list "podMonitor" "probe" "rule" "serviceMonitor" }}
    {{ $selType }}Selector:
      matchLabels:
        prometheus: system
    {{- end }}
    replicas: {{ $p.replicas }}
    scrapeInterval: {{ $p.scrapeInterval }}
    podAntiAffinity: hard
    image:
      {{- if $v.otomi.linodeLkeImageRepository }}
      registry: "{{- $v.otomi.linodeLkeImageRepository }}/quay"
      {{- end }}
      {{- with $g | get "image.prometheus.tag" nil }}
      tag: {{ . }}
      {{- end }}
      pullPolicy: {{ $g | get "image.prometheus.pullPolicy" "IfNotPresent" }}
    podMetadata:
      labels:
        otomi.io/auth: platform
        otomi.io/auth-policy: prometheus
        {{- if $v.apps.istio.defaultRevision }}
        istio.io/rev: {{ $v.apps.istio.defaultRevision | quote }}
        {{- else }}
        sidecar.istio.io/inject: "true"
        {{- end }}
    resources: {{- $p.resources.prometheus | toYaml | nindent 6 }}
    # all team alert managers that will get alerts
    alertingEndpoints:
    - name: po-alertmanager
      namespace: monitoring
      port: http-web
      scheme: http
      apiVersion: v2
      relabelings:
        - targetLabel: __address__
          replacement: po-alertmanager.monitoring.svc.cluster.local:9093
    {{- range $id, $team := (omit $v.teamConfig "admin") }}
    {{- if ($team | get "settings.managedMonitoring.alertmanager" false) }}
    - name: '{{ $id }}-po-alertmanager'
      namespace: 'team-{{ $id }}'
      port: http-web
      scheme: http
      apiVersion: v2
      relabelings:
        - targetLabel: __address__
          replacement: {{ $id }}-po-alertmanager.team-{{ $id }}.svc.cluster.local:9093
    {{- end }}
    {{- end }}
    priorityClassName: otomi-critical
    externalLabels:
      cluster: "{{ $v.cluster.domainSuffix }}"
    replicaExternalLabelName: __replica__
    retention: {{ $p | get "retention" }}
    retentionSize: {{ $p | get "retentionSize" }}
    storageSpec:
      volumeClaimTemplate:
        spec:
          {{- with $v.cluster.defaultStorageClass }}
          storageClassName: {{ . }}
          {{- end }}
          resources:
            requests:
              storage: {{ $p | get "storageSize" }}
    enableAdminAPI: true
    externalUrl: https://{{ $prometheusDomain }}
    {{- if $hasServices }}
    additionalScrapeConfigs:
    {{- range $teamId, $team := $v.teamConfig }}
    {{- $teamServices := ($team | get "services" list) }}
    {{- $domain := $v.cluster.domainSuffix }}
    {{- tpl (readFile "../../helmfile.d/snippets/blackbox-targets.gotmpl") (dict "teamId" $teamId "services" $teamServices "domain" $domain) | nindent 6 }}
    {{- end }}
    {{- end }}
    {{- if $p.remoteWrite.enabled }}
    remoteWrite:
    - url: "{{ $p.remoteWrite.rwConfig.target }}"
      {{- if $p.remoteWrite.rwConfig.basicAuth.enabled }}
      basicAuth:
        username:
          name: prometheus-remote-write-basic-auth
          key: username
        password:
          name: prometheus-remote-write-basic-auth
          key: password
      {{- end }}
      tlsConfig:
        insecureSkipVerify: {{ $p.remoteWrite.rwConfig.insecureSkipVerify }}
      {{- with $p | get "remoteWrite.rwConfig.customConfig" nil }}
      {{- . | nindent 6 }}
      {{- end }}
    {{- end }}
  route:
    main:
      enabled: true
      hostnames:
        - {{ $prometheusDomain }}
      {{- include "prometheus-operator.common-route-opts" $httpRoute | nindent 6 }}

  additionalPodMonitors:
    {{- range $m := (tpl (readFile "pod-monitors.gotmpl") $v | fromYaml) | get "additionalPodMonitors" }}
    - {{- toYaml $m | nindent 6 }}
      additionalLabels:
        prometheus: system
    {{- end }}
  additionalServiceMonitors:
    {{- range $m := (tpl (readFile "service-monitors.gotmpl") $v | fromYaml) | get "additionalServiceMonitors" }}
    - {{- toYaml $m | nindent 6 }}
    {{- end }}
additionalPrometheusRules:
  - name: argocd
    {{- readFile "rules/argocd.yaml" | nindent 4 }}
  - name: blackbox
    {{- readFile "rules/blackbox.yaml" | nindent 4 }}
  - name: cloudnative-pg
    {{- readFile "rules/cloudnative-pg.yaml" | nindent 4 }}
  {{- if $v.platformBackups.database.gitea.enabled }}
  - name: gitea-db-backup
    {{- readFile "rules/gitea-db-backup.yaml" | nindent 4 }}
  {{- end }}
  {{- if $v.platformBackups.database.harbor.enabled }}
  - name: harbor-db-backup
    {{- readFile "rules/harbor-db-backup.yaml" | nindent 4 }}
  {{- end }}
  {{- if $v.platformBackups.database.keycloak.enabled }}
  - name: keycloak-db-backup
    {{- readFile "rules/keycloak-db-backup.yaml" | nindent 4 }}
  {{- end }}
  {{- if (and $pr.enabled $v.otomi.linodeLkeImageRepository) }}
  - name: orcs-compliance
    {{- readFile "rules/orcs-compliance.yaml" | nindent 4 }}
  {{- end }}
alertmanager:
  enabled: {{ $a.enabled }}
  alertmanagerSpec:
    podMetadata:
      labels:
        prometheus: system
        otomi.io/auth: platform
        otomi.io/auth-policy: monitoring
        {{- if $v.apps.istio.defaultRevision }}
        istio.io/rev: {{ $v.apps.istio.defaultRevision | quote }}
        {{- else }}
        sidecar.istio.io/inject: "true"
        {{- end }}
    image:
      {{- if $v.otomi.linodeLkeImageRepository }}
      registry: "{{- $v.otomi.linodeLkeImageRepository }}/quay"
      {{- end }}
       {{- with $a | get "image.tag" nil }}
      tag: {{ . }}
      {{- end }}
      pullPolicy: {{ $a | get "image.pullPolicy" "IfNotPresent" }}
    priorityClassName: otomi-critical
    resources: {{- $a.resources.alertmanager | toYaml | nindent 6 }}
    externalUrl: https://{{ $alertmanagerDomain }}
  config: {{- tpl (readFile "../../helmfile.d/snippets/alertmanager.gotmpl") (dict "instance" $v "root" $v "slackTpl" $slackTpl "opsgenieTpl" $opsgenieTpl) | nindent 4 }}
  route:
    main:
      enabled: true
      hostnames:
        - {{ $alertmanagerDomain }}
      {{- include "prometheus-operator.common-route-opts" $httpRoute | nindent 6 }}
  serviceMonitor:
    relabelings:
      - sourceLabels: [__address__]
        regex: '(\d+)\.(\d+)\.(\d+)\.(\d+):(\d+)'
        replacement: '$5'
        targetLabel: __tmp_pod_ip_port
      - sourceLabels: [service, __meta_kubernetes_namespace]
        separator: "."
        replacement: '$1.svc.cluster.local'
        targetLabel: __tmp_service_namespace
      - sourceLabels: [__tmp_service_namespace, __tmp_pod_ip_port]
        separator: ":"
        targetLabel: __address__
grafana:
  enabled: {{ $g.enabled }}
  defaultDashboardsEnabled: false
  nameOverride: po-grafana
  fullnameOverride: po-grafana
  namespaceOverride: grafana
  defaultDashboardsTimezone: browser
  assertNoLeakedSecrets: false
  image:
    {{- if $v.otomi.linodeLkeImageRepository }}
    registry: "{{- $v.otomi.linodeLkeImageRepository }}/docker"
    {{- end }}
    {{- with $g | get "image.tag" nil }}
    tag: {{ . }}
    {{- end }}
    pullPolicy: {{ $g | get "image.pullPolicy" "IfNotPresent" }}
  resources: {{- $g.resources.grafana | toYaml | nindent 4 }}
  sidecar:
    resources: {{- $g.resources.sidecar | toYaml | nindent 6 }}
    {{- if $v.otomi.linodeLkeImageRepository }}
    image:
      registry: "{{- $v.otomi.linodeLkeImageRepository }}/quay"
    {{- end }}
    dashboards:
      enabled: true
      label: release
      labelValue: grafana-dashboards
  serviceMonitor:
    enabled: {{ $p.enabled }}
    labels:
      prometheus: system
    relabelings:
      - targetLabel: __address__
        replacement: po-grafana.grafana.svc.cluster.local:80
  testFramework:
    enabled: false
  {{- if or $apps.loki.enabled }}
  additionalDataSources:
    {{- if $apps.loki.enabled }}
    - name: Loki
      editable: false
      uid: loki
      type: loki
      access: proxy
      {{- if eq $v.obj.provider.type "linode" }}
      url: http://loki-query-frontend-headless.monitoring:3101
      {{- else }}
      url: http://loki-headless.monitoring:3101
      {{- end }}
      basicAuth: true
      basicAuthUser: otomi-admin
      secureJsonData:
        basicAuthPassword: {{ $v.apps.loki.adminPassword | quote }}
    {{- end }}
  {{- end }}
  adminPassword: {{ $g | get "adminPassword" $v.otomi.adminPassword | quote }}
  grafana.ini: {{- $grafanaIni | nindent 4 }}
    server:
      root_url: https://{{ $grafanaDomain }}
      # serve_from_sub_path: true
    security:
      allow_embedding: true
  route:
    main:
      enabled: true
      hostnames:
        - {{ $grafanaDomain }}
      {{- include "prometheus-operator.common-route-opts" $httpRoute | nindent 6 }}
  podLabels:
    otomi.io/auth: platform
    otomi.io/auth-policy: monitoring

kubernetesServiceMonitors:
  enabled: {{ $p.enabled }}

kubeStateMetrics:
  enabled: {{ $p.enabled }}

kube-state-metrics:
  prometheus:
    monitor:
      additionalLabels:
        prometheus: system
  image:
    {{- if $v.otomi.linodeLkeImageRepository }}
    registry: "{{- $v.otomi.linodeLkeImageRepository }}/k8s"
    {{- end }}
    {{- with $p | get "image.kube-state-metrics.tag" nil }}
    tag: {{  . }}
    {{- end }}
    pullPolicy: {{ $p | get "image.kube-state-metrics.pullPolicy" "IfNotPresent" }}
  resources:
    {{- with $p | get "resources.kube-state-metrics" nil }}
      {{- toYaml . | nindent 4 }}
    {{- end }}


nodeExporter:
  enabled: {{ $p.enabled }}

prometheus-node-exporter:
  prometheus:
    monitor:
      additionalLabels:
        prometheus: system
  image:
    {{- if $v.otomi.linodeLkeImageRepository }}
    registry: "{{- $v.otomi.linodeLkeImageRepository }}/quay"
    {{- end }}
    {{- with $p | get "image.node-exporter.tag" nil }}
    tag: {{ . }}
    {{- end }}
    pullPolicy: {{ $p | get "image.node-exporter.pullPolicy" "IfNotPresent" }}
  resources:
    {{- with $p | get "resources.node-exporter" nil }}
      {{- toYaml . | nindent 4 }}
    {{- end }}
  priorityClassName: otomi-critical

kubeProxy:
  enabled: false
kubeScheduler:
  enabled: false
kubeControllerManager:
  enabled: false

{{- if eq $v.cluster.linode.tier "enterprise" }}
coreDns:
  service:
    selector:
      k8s-app: coredns
{{- end }}