feat: bootstrap ArgoCD + structure GitOps k8s

- k8s/argocd-bootstrap/values.yaml : ArgoCD Helm values (ingress Traefik,
  resources limités, dex désactivé)
- k8s/apps-of-apps/ : root Application + monitoring Application
- k8s/infra/monitoring/ : kube-prometheus-stack v85.0.2 (Grafana, Prometheus,
  AlertManager, node-exporter daemonset)
  - Scrape additionnels : storage-01:9100, gpu-01:9100 (node), :9101 (ROCm),
    llama-server :1234/:1236/:1237
  - AlertManager webhook → http://192.168.10.1:9093/webhook (Hermes monitor)
  - Ressources dimensionnées pour compute 8GB
  - kubeEtcd/Scheduler/ControllerManager/Proxy désactivés (Talos)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

k8s/apps-of-apps/apps/monitoring.yaml

@@ -0,0 +1,23 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: monitoring
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/Alkatrazz24/Funk-lab.git
+    targetRevision: main
+    path: k8s/infra/monitoring
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: monitoring
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

k8s/apps-of-apps/root.yaml

@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: root
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/Alkatrazz24/Funk-lab.git
+    targetRevision: main
+    path: k8s/apps-of-apps/apps
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true

k8s/argocd-bootstrap/values.yaml

@@ -0,0 +1,54 @@
+global:
+  domain: argocd.lab.local
+
+configs:
+  params:
+    server.insecure: true  # TLS géré par Traefik
+
+server:
+  ingress:
+    enabled: true
+    ingressClassName: traefik
+    hostname: argocd.lab.local
+
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      memory: 256Mi
+
+repoServer:
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      memory: 256Mi
+
+applicationSet:
+  resources:
+    requests:
+      cpu: 50m
+      memory: 64Mi
+    limits:
+      memory: 128Mi
+
+notifications:
+  resources:
+    requests:
+      cpu: 50m
+      memory: 64Mi
+    limits:
+      memory: 128Mi
+
+redis:
+  resources:
+    requests:
+      cpu: 50m
+      memory: 64Mi
+    limits:
+      memory: 128Mi
+
+dex:
+  enabled: false

k8s/infra/monitoring/helmrelease.yaml

@@ -0,0 +1,36 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: kube-prometheus-stack
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://prometheus-community.github.io/helm-charts
+    chart: kube-prometheus-stack
+    targetRevision: 85.0.2
+    helm:
+      valuesFiles:
+        - $values/k8s/infra/monitoring/values.yaml
+  sources:
+    - repoURL: https://prometheus-community.github.io/helm-charts
+      chart: kube-prometheus-stack
+      targetRevision: 85.0.2
+      helm:
+        valueFiles:
+          - $values/k8s/infra/monitoring/values.yaml
+    - repoURL: https://github.com/Alkatrazz24/Funk-lab.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: monitoring
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

k8s/infra/monitoring/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: monitoring

k8s/infra/monitoring/values.yaml

@@ -0,0 +1,140 @@
+# kube-prometheus-stack — cluster Funk
+# Ressources limitées pour compute-02/03 (8 GB RAM)
+
+grafana:
+  ingress:
+    enabled: true
+    ingressClassName: traefik
+    hosts:
+      - grafana.lab.local
+  adminPassword: "funk-grafana"
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      memory: 256Mi
+  persistence:
+    enabled: false
+
+prometheus:
+  prometheusSpec:
+    retention: 15d
+    retentionSize: "8GB"
+    resources:
+      requests:
+        cpu: 200m
+        memory: 512Mi
+      limits:
+        memory: 1Gi
+    storageSpec:
+      volumeClaimTemplate:
+        spec:
+          accessModes: ["ReadWriteOnce"]
+          resources:
+            requests:
+              storage: 20Gi
+
+    # Scrape des nœuds hors cluster (storage-01, gpu-01)
+    additionalScrapeConfigs:
+      - job_name: storage-01
+        static_configs:
+          - targets: ['192.168.10.1:9100']
+            labels:
+              instance: storage-01
+              role: gateway
+
+      - job_name: gpu-01-node
+        static_configs:
+          - targets: ['192.168.10.20:9100']
+            labels:
+              instance: gpu-01
+              role: gpu
+
+      - job_name: gpu-01-rocm
+        static_configs:
+          - targets: ['192.168.10.20:9101']
+            labels:
+              instance: gpu-01
+              role: gpu
+
+      - job_name: llama-server-gpu
+        static_configs:
+          - targets: ['192.168.10.20:1234']
+            labels:
+              instance: gpu-01
+              model: qwen3-8b
+              type: gpu
+
+      - job_name: llama-server-system
+        static_configs:
+          - targets: ['192.168.10.20:1236']
+            labels:
+              instance: gpu-01
+              model: qwen3-1.7b-system
+              type: cpu
+
+      - job_name: llama-server-monitor
+        static_configs:
+          - targets: ['192.168.10.20:1237']
+            labels:
+              instance: gpu-01
+              model: qwen3-1.7b-monitor
+              type: cpu
+
+alertmanager:
+  alertmanagerSpec:
+    resources:
+      requests:
+        cpu: 50m
+        memory: 64Mi
+      limits:
+        memory: 128Mi
+  config:
+    global:
+      resolve_timeout: 5m
+    route:
+      group_by: ['alertname', 'instance']
+      group_wait: 30s
+      group_interval: 5m
+      repeat_interval: 4h
+      receiver: hermes-monitor
+    receivers:
+      - name: hermes-monitor
+        webhook_configs:
+          - url: 'http://192.168.10.1:9093/webhook'
+            send_resolved: true
+
+prometheusOperator:
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      memory: 256Mi
+
+kube-state-metrics:
+  resources:
+    requests:
+      cpu: 50m
+      memory: 64Mi
+    limits:
+      memory: 128Mi
+
+nodeExporter:
+  resources:
+    requests:
+      cpu: 50m
+      memory: 32Mi
+    limits:
+      memory: 64Mi
+
+# Désactiver etcd/scheduler monitoring (Talos — non accessible)
+kubeEtcd:
+  enabled: false
+kubeScheduler:
+  enabled: false
+kubeControllerManager:
+  enabled: false
+kubeProxy:
+  enabled: false