add kube-prometheus-stack

Signed-off-by: gwg313 <gwg313@pm.me>

remove vals

Signed-off-by: gwg313 <gwg313@pm.me>

management/platform-apps/kustomization.yaml

@@ -8,6 +8,7 @@ resources:
   - tetragon-policies.yaml
   - sealed-secrets.yaml
   - cert-manager.yaml
+  - monitoring.yaml
   - nfs-subdir.yaml
   - forgejo.yaml
   - navidrome.yaml

management/platform-apps/kyverno-policies.yaml

@@ -21,3 +21,4 @@ spec:
     syncOptions:
       - CreateNamespace=false
       - ServerSideApply=true
+      - Replace=true # <-- Policies have immutable fields so this helps deal with updates

management/platform-apps/monitoring.yaml

@@ -0,0 +1,23 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: monitoring
+  namespace: argocd
+  annotations:
+    argoproj.io/sync-wave: "-5"
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/gwg313/homelab-gitops.git
+    targetRevision: main
+    path: platform/monitoring
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: monitoring
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

platform/kyverno/policies/generate-ns-network-baseline.yaml

@@ -29,6 +29,7 @@ spec:
                 - cert-manager
                 - sealed-secrets
                 - nfs-subdir-external-provisioner
+                - monitoring
       generate:
         apiVersion: cilium.io/v2
         kind: CiliumNetworkPolicy

platform/kyverno/policies/require-requests-limits.yaml

@@ -33,6 +33,7 @@ spec:
                 - cert-manager
                 - sealed-secrets
                 - nfs-subdir-external-provisioner
+                - monitoring
       validate:
         message: "Resource discipline violation: Containers must declare cpu/memory requests and limits."
         pattern:

platform/monitoring/Chart.yaml

@@ -0,0 +1,9 @@
+apiVersion: v2
+name: cluster-monitoring
+description: chart for cluster monitoring stack
+type: application
+version: 1.0.0
+dependencies:
+  - name: kube-prometheus-stack
+    version: "85.1.3"
+    repository: "https://prometheus-community.github.io/helm-charts"

platform/monitoring/templates/namespace.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: monitoring
+  labels:
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/warn: privileged