init

charts/monitoring/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+version: 1.0.0
+name: monitoring

charts/monitoring/templates/falco.yaml

@@ -0,0 +1,25 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: '{{ .Release.Name }}-falco'
+spec:
+  interval: 1h
+  url: https://falcosecurity.github.io/charts
+
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: '{{ .Release.Name }}-falco'
+spec:
+  chart:
+    spec:
+      chart: falco
+      reconcileStrategy: ChartVersion
+      sourceRef:
+        apiVersion: source.toolkit.fluxcd.io/v1
+        kind: HelmRepository
+        name: '{{ .Release.Name }}-falco'
+        namespace: '{{ .Release.Namespace }}'
+  interval: 1h
+  values: {}

charts/monitoring/templates/kube-prometheus-stack.yaml

@@ -0,0 +1,53 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: "{{ .Release.Name }}-prometheus-community"
+spec:
+  interval: 1h
+  url: https://prometheus-community.github.io/helm-charts/
+
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: "{{ .Release.Name }}-prometheus-community"
+spec:
+  chart:
+    spec:
+      chart: kube-prometheus-stack
+      reconcileStrategy: ChartVersion
+      sourceRef:
+        apiVersion: source.toolkit.fluxcd.io/v1
+        kind: HelmRepository
+        name: "{{ .Release.Name }}-prometheus-community"
+        namespace: "{{ .Release.Namespace }}"
+  interval: 1h
+  values:
+    grafana:
+      env:
+        GF_SERVER_ROOT_URL: https://grafana.olsen.cloud # TODO
+
+---
+apiVersion: homelab.mortenolsen.pro/v1
+kind: HttpService
+metadata:
+  name: "{{ .Release.Name }}-prometheus-community"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+  subdomain: "{{ .Values.grafana.subdomain }}"
+  destination:
+    host: "{{ .Release.Name }}-prometheus-community-grafana.{{ .Release.Namespace }}.svc.cluster.local"
+    port:
+      number: 80
+
+---
+apiVersion: homelab.mortenolsen.pro/v1
+kind: OidcClient
+metadata:
+  name: "{{ .Release.Name }}-grafana"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+  redirectUris:
+    - path: /login/generic_oauth
+      subdomain: "{{ .Values.grafana.subdomain }}"
+      matchingMode: strict

charts/monitoring/templates/kyverno.yaml

@@ -0,0 +1,25 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: '{{ .Release.Name }}-kyverno'
+spec:
+  interval: 1h
+  url: https://kyverno.github.io/kyverno/
+
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: '{{ .Release.Name }}-kyverno'
+spec:
+  chart:
+    spec:
+      chart: kyverno
+      reconcileStrategy: ChartVersion
+      sourceRef:
+        apiVersion: source.toolkit.fluxcd.io/v1
+        kind: HelmRepository
+        name: '{{ .Release.Name }}-kyverno'
+        namespace: '{{ .Release.Namespace }}'
+  interval: 1h
+  values: {}

charts/monitoring/templates/loki.yaml

@@ -0,0 +1,121 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: '{{ .Release.Name }}-loki'
+spec:
+  interval: 1h
+  url: https://grafana.github.io/helm-charts
+
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: '{{ .Release.Name }}-loki'
+spec:
+  chart:
+    spec:
+      chart: loki
+      reconcileStrategy: ChartVersion
+      sourceRef:
+        apiVersion: source.toolkit.fluxcd.io/v1
+        kind: HelmRepository
+        name: '{{ .Release.Name }}-loki'
+        namespace: '{{ .Release.Namespace }}'
+  interval: 1h
+  values:
+    deploymentMode: SingleBinary
+    loki:
+      auth_enabled: false
+      server:
+        http_listen_port: 3100
+
+      # memberlist:
+      #   join_members:
+      #     - loki-memberlist
+
+      schemaConfig:
+        configs:
+          - from: 2020-05-15
+            store: tsdb
+            object_store: filesystem
+            schema: v13
+            index:
+              prefix: index_
+              period: 24h
+
+      storage:
+        type: filesystem
+
+      storage_config:
+        filesystem:
+          directory: /loki/chunks
+
+      limits_config:
+        reject_old_samples: true
+        reject_old_samples_max_age: 168h
+        max_cache_freshness_per_query: 10m
+        split_queries_by_interval: 15m
+        volume_enabled: true
+
+      common:
+        path_prefix: /loki
+        storage:
+          filesystem:
+            chunks_directory: /loki/chunks
+            rules_directory: /loki/rules
+        replication_factor: 1
+        ring:
+          instance_addr: 127.0.0.1
+          kvstore:
+            store: inmemory
+
+    # Enable persistent storage
+    singleBinary:
+      persistence:
+        enabled: true
+        size: 10Gi
+        storageClass: '{{ .Values.globals.environment }}' # Uses default storage class
+      extraVolumeMounts:
+        - name: storage
+          mountPath: /loki
+
+    backend:
+      replicas: 0
+    read:
+      replicas: 0
+    write:
+      replicas: 0
+
+    ingester:
+      replicas: 0
+    querier:
+      replicas: 0
+    queryFrontend:
+      replicas: 0
+    queryScheduler:
+      replicas: 0
+    distributor:
+      replicas: 0
+    compactor:
+      replicas: 0
+    indexGateway:
+      replicas: 0
+    bloomCompactor:
+      replicas: 0
+    bloomGateway:
+      replicas: 0
+    promtail:
+      enabled: true
+      config:
+        snippets:
+          extraScrapeConfigs: |
+            - job_name: kubernetes-pods
+              kubernetes_sd_configs:
+                - role: pod
+              relabel_configs:
+                - source_labels: ["__meta_kubernetes_pod_container_name"]
+                  target_label: "container"
+                - source_labels: ["__meta_kubernetes_pod_name"]
+                  target_label: "pod"
+                - source_labels: ["__meta_kubernetes_pod_namespace"]
+                  target_label: "namespace"

charts/monitoring/templates/trivy.yaml

@@ -0,0 +1,25 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: '{{ .Release.Name }}-aqua'
+spec:
+  interval: 1h
+  url: https://aquasecurity.github.io/helm-charts/
+
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: '{{ .Release.Name }}-aqua'
+spec:
+  chart:
+    spec:
+      chart: trivy-operator
+      reconcileStrategy: ChartVersion
+      sourceRef:
+        apiVersion: source.toolkit.fluxcd.io/v1
+        kind: HelmRepository
+        name: '{{ .Release.Name }}-aqua'
+        namespace: '{{ .Release.Namespace }}'
+  interval: 1h
+  values: {}

charts/monitoring/values.yaml

@@ -0,0 +1,4 @@
+globals:
+  environment: prod
+grafana:
+  subdomain: grafana