feat(monitoring): replace scrape dump with vmagent

prometheus-stack/k8s/README.md

@@ -0,0 +1,17 @@
+# VictoriaMetrics
+
+The `victoria-operator` Helm release converts Prometheus Operator
+`ServiceMonitor` resources into owned `VMServiceScrape` resources. The
+`VMAgent` selects converted scrapes labeled `release: prometheus-stack` in all
+namespaces and writes them to the existing single-node VictoriaMetrics
+instance. Changes to selected `ServiceMonitor` resources are reconciled
+automatically; there is no copied Prometheus scrape-config blob to regenerate.
+
+The agent drops targets for the Prometheus server service to avoid duplicating
+its self-scrape. `scraper: victoria` identifies the samples ingested by this
+VMAgent.
+
+The VictoriaMetrics Operator chart and its CRDs are installed before the
+Kubernetes manifests by the normal deploy workflow. On a cluster where the
+operator CRDs are not installed yet, CI skips the server-side dry-run of the
+`VMAgent` resource; the deploy installs the chart before applying that resource.

prometheus-stack/k8s/victoria-operator-values.yaml

@@ -0,0 +1,12 @@
+nameOverride: victoria-operator
+
+operator:
+  enable_converter_ownership: true
+
+resources:
+  requests:
+    cpu: 50m
+    memory: 96Mi
+  limits:
+    cpu: 200m
+    memory: 256Mi

prometheus-stack/k8s/victoria-secrets.yaml.example

@@ -1,8 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: victoria-secrets
-  namespace: prometheus
-type: Opaque
-stringData:
-  uptime-kuma-password: "REPLACE_ME"

prometheus-stack/k8s/victoria.yaml

@@ -1,23 +1,4 @@
 apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: victoria
-  namespace: prometheus
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: victoria
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: prometheus-stack-kube-prom-prometheus
-subjects:
-  - kind: ServiceAccount
-    name: victoria
-    namespace: prometheus
----
-apiVersion: v1
 kind: Service
 metadata:
   name: victoria-metrics
@@ -59,7 +40,6 @@ spec:
       labels:
         app: victoria-metrics
     spec:
-      serviceAccountName: victoria
       containers:
         - name: victoria
           image: victoriametrics/victoria-metrics:v1.153.0-scratch
@@ -67,8 +47,6 @@ spec:
             - -storageDataPath=/vmdata
             - -retentionPeriod=30d
             - -httpListenAddr=:8428
-            - -promscrape.config=/etc/vm/conf/scrape.yaml
-            - -promscrape.configCheckInterval=60s
           ports:
             - containerPort: 8428
           readinessProbe:
@@ -88,15 +66,6 @@ spec:
           volumeMounts:
             - name: vmdata
               mountPath: /vmdata
-            - name: scrape-config
-              mountPath: /etc/vm/conf
-              readOnly: true
-            - name: vm-secrets
-              mountPath: /etc/vm/secrets
-              readOnly: true
-            - name: prom-admission-ca
-              mountPath: /etc/prometheus/certs
-              readOnly: true
           resources:
             requests:
               cpu: "100m"
@@ -108,15 +77,3 @@ spec:
         - name: vmdata
           persistentVolumeClaim:
             claimName: victoria-pvc
-        - name: scrape-config
-          configMap:
-            name: victoria-scrape
-        - name: vm-secrets
-          secret:
-            secretName: victoria-secrets
-        - name: prom-admission-ca
-          secret:
-            secretName: prometheus-stack-kube-prom-admission
-            items:
-              - key: ca
-                path: 0_prometheus_prometheus-stack-kube-prom-admission_ca

prometheus-stack/k8s/vmagent.yaml

@@ -0,0 +1,29 @@
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMAgent
+metadata:
+  name: vmagent
+  namespace: prometheus
+spec:
+  image:
+    tag: v1.153.0
+  scrapeInterval: 30s
+  externalLabels:
+    scraper: victoria
+  serviceScrapeNamespaceSelector: {}
+  serviceScrapeSelector:
+    matchLabels:
+      release: prometheus-stack
+  globalScrapeRelabelConfigs:
+    - action: drop
+      source_labels:
+        - __meta_kubernetes_service_name
+      regex: prometheus-stack-kube-prom-prometheus
+  remoteWrite:
+    - url: http://victoria-metrics.prometheus.svc.cluster.local:8428/api/v1/write
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      cpu: "1000m"
+      memory: 1Gi