refactor(k8s): consolidate to infra/+apps/ single-source tree, dedicated per-app CNPG (authentik-db/temporal-db), wire monitoring-config, forgejo→cicd ns, drop orphan/stale (data-schemas, ollama, story-crater, sqs/argocd, key-rotation)

2026-07-23 20:54:02 -07:00
parent 1c7395d9e1
commit e6f2ab1423
241 changed files with 467 additions and 10416 deletions
@@ -0,0 +1,75 @@
+# k8s/monitoring/blackbox-exporter-values.yaml
+# Active black-box HTTP probing of every ingress-exposed service — gives an
+# uptime/availability signal independent of real traffic. Homelab services
+# like Vault/MinIO/Longhorn UI get almost no organic requests, so ingress RED
+# metrics alone can't tell "idle" from "down"; this closes that gap.
+
+config:
+  modules:
+    http_2xx:
+      prober: http
+      timeout: 5s
+      http:
+        valid_http_versions: ["HTTP/1.1", "HTTP/2.0"]
+        valid_status_codes: []   # any 2xx
+        follow_redirects: true
+        preferred_ip_protocol: "ip4"
+        tls_config:
+          insecure_skip_verify: true   # homelab-ca is a private CA; skip verify for simplicity
+
+resources:
+  requests:
+    cpu: 20m
+    memory: 32Mi
+  limits:
+    cpu: 100m
+    memory: 64Mi
+
+tolerations:
+  - key: node-role.kubernetes.io/control-plane
+    operator: Exists
+    effect: NoSchedule
+
+serviceMonitor:
+  enabled: true
+  selfMonitor:
+    enabled: true
+  defaults:
+    interval: 30s
+    scrapeTimeout: 10s
+    module: http_2xx
+  targets:
+    - name: grafana
+      url: https://grafana.riotpiao.com/
+    - name: loki
+      url: https://loki.riotpiao.com/ready
+    - name: authentik
+      url: https://authentik.riotpiao.com/-/health/ready/
+    - name: vault
+      url: https://vault.riotpiao.com/v1/sys/health
+    - name: minio-console
+      url: https://minio.riotpiao.com/
+    - name: minio-api
+      url: https://minio-api.riotpiao.com/minio/health/live
+    - name: prometheus
+      url: https://prometheus.riotpiao.com/-/healthy
+    - name: portainer
+      url: https://portainer.riotpiao.com/
+    - name: forgejo
+      url: https://forgejo.riotpiao.com/api/healthz
+    - name: argocd
+      url: https://argocd.riotpiao.com/healthz
+    - name: longhorn
+      url: https://longhorn.riotpiao.com/
+
+prometheusRule:
+  enabled: true
+  rules:
+    - alert: ServiceProbeDown
+      expr: probe_success == 0
+      for: 5m
+      labels:
+        severity: critical
+      annotations:
+        summary: "Probe failing for {{ $labels.instance }}"
+        description: "Blackbox probe for {{ $labels.instance }} has failed for more than 5 minutes."