Funk-lab/k8s/infra/monitoring/values.yaml

# kube-prometheus-stack — cluster Funk
# Ressources limitées pour compute-02/03 (8 GB RAM)

grafana:
  initChownData:
    enabled: false
  grafana.ini:
    database:
      type: postgres
      host: 192.168.10.1:5432
      name: grafana
      user: grafana
    server:
      # URL canonique publique HTTPS (construit le redirect_uri OAuth)
      root_url: https://grafana.funklab.online
    # SSO OIDC via Authentik (app « grafana » dans l'UI Authentik).
    # auth_url = navigateur (domaine public) ; token/api = serveur→serveur (Service
    # interne, les pods ne résolvent pas le domaine). Le login local reste actif
    # (break-glass : admin / adminPassword ci-dessous) — ne pas mettre disable_login_form.
    auth.generic_oauth:
      enabled: true
      name: Authentik
      client_id: grafana
      client_secret: $__env{GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET}
      scopes: openid profile email
      auth_url: https://auth.funklab.online/application/o/authorize/
      token_url: http://authentik.auth.svc.cluster.local:9000/application/o/token/
      api_url: http://authentik.auth.svc.cluster.local:9000/application/o/userinfo/
      # Repli si l'utilisateur Authentik n'a pas d'email : sans ça Grafana tente un
      # endpoint /emails inexistant chez Authentik → 404 « InternalError » au login.
      login_attribute_path: preferred_username
      email_attribute_path: email || preferred_username
      # Membre du groupe lab-admins → Admin, sinon Viewer
      role_attribute_path: contains(groups[*], 'lab-admins') && 'Admin' || 'Viewer'
      role_attribute_strict: false
      allow_assign_grafana_admin: true
  envFromSecrets:
    - name: grafana-db-secret
    - name: grafana-oauth-secret
  ingress:
    enabled: true
    ingressClassName: traefik
    hosts:
      - grafana.lab.local
  adminPassword: "funk-grafana"
  resources:
    requests:
      cpu: 100m
      memory: 256Mi
    limits:
      memory: 1Gi
  persistence:
    enabled: true
    storageClassName: nfs
    size: 2Gi

prometheus:
  ingress:
    enabled: true
    ingressClassName: traefik
    hosts:
      - prometheus.lab.local
    paths:
      - /
    pathType: Prefix

  prometheusSpec:
    retention: 15d
    retentionSize: "8GB"
    resources:
      requests:
        cpu: 200m
        memory: 512Mi
      limits:
        memory: 1Gi
    storageSpec:
      volumeClaimTemplate:
        spec:
          storageClassName: nfs
          accessModes: ["ReadWriteOnce"]
          resources:
            requests:
              storage: 20Gi

    # Scrape des nœuds hors cluster (storage-01, gpu-01)
    additionalScrapeConfigs:
      - job_name: storage-01
        static_configs:
          - targets: ['192.168.10.1:9100']
            labels:
              instance: storage-01
              role: gateway

      - job_name: gpu-01-node
        static_configs:
          - targets: ['192.168.10.20:9100']
            labels:
              instance: gpu-01
              role: gpu

      - job_name: llama-server-gpu
        static_configs:
          - targets: ['192.168.10.20:1234']
            labels:
              instance: gpu-01
              model: qwen3-8b
              type: gpu

alertmanager:
  ingress:
    enabled: true
    ingressClassName: traefik
    hosts:
      - alertmanager.lab.local
    paths:
      - /
    pathType: Prefix

  alertmanagerSpec:
    resources:
      requests:
        cpu: 50m
        memory: 64Mi
      limits:
        memory: 128Mi
  config:
    global:
      resolve_timeout: 5m
    route:
      group_by: ['alertname', 'instance']
      group_wait: 30s
      group_interval: 5m
      repeat_interval: 4h
      receiver: hermes-monitor
      routes:
        # Watchdog (heartbeat interne kube-prometheus-stack) — silencé
        - matchers:
            - alertname = "Watchdog"
          receiver: "null"
          repeat_interval: 24h
    receivers:
      - name: "null"
      - name: hermes-monitor
        webhook_configs:
          - url: 'http://192.168.10.1:9093/webhook'
            send_resolved: true
          - url: 'http://n8n.lab.local/webhook/alerts'
            send_resolved: true

prometheusOperator:
  resources:
    requests:
      cpu: 100m
      memory: 128Mi
    limits:
      memory: 256Mi

kube-state-metrics:
  resources:
    requests:
      cpu: 50m
      memory: 64Mi
    limits:
      memory: 128Mi

nodeExporter:
  resources:
    requests:
      cpu: 50m
      memory: 32Mi
    limits:
      memory: 64Mi

prometheus-node-exporter:
  extraArgs:
    - --collector.rapl

# Désactiver etcd/scheduler monitoring (Talos — non accessible)
kubeEtcd:
  enabled: false
kubeScheduler:
  enabled: false
kubeControllerManager:
  enabled: false
kubeProxy:
  enabled: false