Initial commit

infrastructure/prometheus/values.yaml

@@ -0,0 +1,87 @@
+# values/prometheus.values.yaml
+
+# Prometheus Operator configuration
+prometheus:
+  prometheusSpec:
+    # High availability with 2 replicas
+    replicas: 2
+    
+    # Reduce retention to lower I/O on shared NVMe storage
+    retention: 7d
+
+    storageSpec:
+      volumeClaimTemplate:
+        spec:
+          storageClassName: rook-ceph-block
+          accessModes:
+            - ReadWriteOnce
+          resources:
+            requests:
+              storage: 20Gi
+
+    # Enable ServiceMonitor discovery across all namespaces
+    # NOTE: empty {} is falsy in Go templates, so the chart falls back to
+    # requiring release: <release-name> label. Setting NilUsesHelmValues=false
+    # ensures the empty selector matches ALL monitors.
+    serviceMonitorSelector: {}
+    serviceMonitorSelectorNilUsesHelmValues: false
+    serviceMonitorNamespaceSelector: {}
+    podMonitorSelector: {}
+    podMonitorSelectorNilUsesHelmValues: false
+    podMonitorNamespaceSelector: {}
+
+    # Mount Talos client certificates
+    secrets:
+      - talos-client-cert
+
+    # Additional scrape configurations for Talos
+    # NOTE: Talos apid endpoint at port 50000 returns HTTP 415 errors with Prometheus v2.x
+    # This is a known compatibility issue between Talos v1.10.x and modern Prometheus
+    # The issue is that Prometheus sends Accept headers for content negotiation that
+    # Talos apid doesn't understand. Workarounds require a reverse proxy or using kubelet.
+    # For now, Talos metrics are disabled. Node metrics are still available via kubelet.
+    additionalScrapeConfigs: []
+    
+    # DISABLED - Talos apid scraping (returns 415 Unsupported Media Type)
+    # - job_name: 'talos-apid'
+    #   honor_timestamps: true
+    #   scrape_interval: 30s
+    #   scrape_timeout: 10s
+    #   metrics_path: /metrics
+    #   scheme: https
+    #   scrape_protocols: []
+    #   enable_http2: false
+    #   enable_compression: false
+    #   tls_config:
+    #     ca_file: /etc/prometheus/secrets/talos-client-cert/ca.crt
+    #     cert_file: /etc/prometheus/secrets/talos-client-cert/client.crt
+    #     key_file: /etc/prometheus/secrets/talos-client-cert/client.key
+    #     insecure_skip_verify: false
+    #   kubernetes_sd_configs:
+    #     - role: node
+    #   relabel_configs:
+    #     - source_labels: [__address__]
+    #       regex: '(.*):.*'
+    #       replacement: '${1}:50000'
+    #       target_label: __address__
+    #     - source_labels: [__meta_kubernetes_node_name]
+    #       target_label: node
+
+  # Ingress disabled - Istio VirtualService handles routing
+  ingress:
+    enabled: false
+
+alertmanager:
+  enabled: true
+
+# Disable node-exporter due to PodSecurity restrictions
+prometheus-node-exporter:
+  enabled: false
+
+# Enable kube-state-metrics for Kubernetes object metrics
+kube-state-metrics:
+  enabled: true
+
+# Grafana (included in kube-prometheus-stack)
+grafana:
+  enabled: false  # We deploy Grafana separately