# values/prometheus.values.yaml

# Prometheus Operator configuration
prometheus:
  prometheusSpec:
    replicas: 1
    
    # Reduce retention to lower I/O on shared NVMe storage
    retention: 7d

    storageSpec:
      volumeClaimTemplate:
        spec:
          storageClassName: rook-ceph-block
          accessModes:
            - ReadWriteOnce
          resources:
            requests:
              storage: 20Gi

    # Enable ServiceMonitor discovery across all namespaces
    # NOTE: empty {} is falsy in Go templates, so the chart falls back to
    # requiring release: <release-name> label. Setting NilUsesHelmValues=false
    # ensures the empty selector matches ALL monitors.
    serviceMonitorSelector: {}
    serviceMonitorSelectorNilUsesHelmValues: false
    serviceMonitorNamespaceSelector: {}
    podMonitorSelector: {}
    podMonitorSelectorNilUsesHelmValues: false
    podMonitorNamespaceSelector: {}

    # Mount Talos client certificates
    secrets:
      - talos-client-cert

    # Additional scrape configurations for Talos
    # NOTE: Talos apid endpoint at port 50000 returns HTTP 415 errors with Prometheus v2.x
    # This is a known compatibility issue between Talos v1.10.x and modern Prometheus
    # The issue is that Prometheus sends Accept headers for content negotiation that
    # Talos apid doesn't understand. Workarounds require a reverse proxy or using kubelet.
    # For now, Talos metrics are disabled. Node metrics are still available via kubelet.
    additionalScrapeConfigs: []
    
    # DISABLED - Talos apid scraping (returns 415 Unsupported Media Type)
    # - job_name: 'talos-apid'
    #   honor_timestamps: true
    #   scrape_interval: 30s
    #   scrape_timeout: 10s
    #   metrics_path: /metrics
    #   scheme: https
    #   scrape_protocols: []
    #   enable_http2: false
    #   enable_compression: false
    #   tls_config:
    #     ca_file: /etc/prometheus/secrets/talos-client-cert/ca.crt
    #     cert_file: /etc/prometheus/secrets/talos-client-cert/client.crt
    #     key_file: /etc/prometheus/secrets/talos-client-cert/client.key
    #     insecure_skip_verify: false
    #   kubernetes_sd_configs:
    #     - role: node
    #   relabel_configs:
    #     - source_labels: [__address__]
    #       regex: '(.*):.*'
    #       replacement: '${1}:50000'
    #       target_label: __address__
    #     - source_labels: [__meta_kubernetes_node_name]
    #       target_label: node

  # Ingress disabled - Istio VirtualService handles routing
  ingress:
    enabled: false

alertmanager:
  enabled: true
  alertmanagerSpec:
    replicas: 1

# Disable node-exporter due to PodSecurity restrictions
prometheus-node-exporter:
  enabled: false

# Enable kube-state-metrics for Kubernetes object metrics
kube-state-metrics:
  enabled: true

# Grafana (included in kube-prometheus-stack)
grafana:
  enabled: false  # We deploy Grafana separately