apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: kube-prometheus-stack
  namespace: monitoring
spec:
  interval: 15m
  chart:
    spec:
      chart: kube-prometheus-stack
      version: ">=58.0.0 <60.0.0"
      sourceRef:
        kind: HelmRepository
        name: prometheus-community
        namespace: flux-system
      interval: 60m
  install:
    crds: CreateReplace
    remediation:
      retries: 3
  upgrade:
    crds: CreateReplace
    remediation:
      retries: 3
  values:
    grafana:
      enabled: true
      adminPassword: "${GRAFANA_ADMIN_PASSWORD}"  # inject via Secret/substitution
      ingress:
        enabled: true
        ingressClassName: nginx
        annotations:
          cert-manager.io/cluster-issuer: letsencrypt-prod
          nginx.ingress.kubernetes.io/ssl-redirect: "true"
        hosts:
          - grafana.leeworks.dev
        tls:
          - secretName: grafana-tls
            hosts:
              - grafana.leeworks.dev
      persistence:
        enabled: true
        size: 5Gi
      sidecar:
        dashboards:
          enabled: true
    prometheus:
      prometheusSpec:
        retention: 30d
        storageSpec:
          volumeClaimTemplate:
            spec:
              resources:
                requests:
                  storage: 20Gi
        # Scrape pods with prometheus.io/scrape=true annotations
        podMonitorNamespaceSelector: {}
        podMonitorSelector: {}
        serviceMonitorNamespaceSelector: {}
        serviceMonitorSelector: {}
        # Additional scrape configs for annotation-based discovery
        additionalScrapeConfigs:
          - job_name: 'kubernetes-pods'
            kubernetes_sd_configs:
              - role: pod
            relabel_configs:
              - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
                action: keep
                regex: "true"
              - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path]
                action: replace
                target_label: __metrics_path__
                regex: (.+)
              - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
                action: replace
                regex: ([^:]+)(?::\d+)?;(\d+)
                replacement: $1:$2
                target_label: __address__
              - action: labelmap
                regex: __meta_kubernetes_pod_label_(.+)
              - source_labels: [__meta_kubernetes_namespace]
                action: replace
                target_label: kubernetes_namespace
              - source_labels: [__meta_kubernetes_pod_name]
                action: replace
                target_label: kubernetes_pod_name
    alertmanager:
      enabled: true
      config:
        global:
          slack_api_url_file: /etc/alertmanager/secrets/gatus-slack-webhook/url
        route:
          receiver: slack-api-alerts
          group_by: [alertname, namespace]
          group_wait: 30s
          group_interval: 5m
          repeat_interval: 4h
        receivers:
          - name: slack-api-alerts
            slack_configs:
              - channel: '#api-alerts'
                title: '{{ .CommonAnnotations.summary }}'
                text: '{{ range .Alerts }}{{ .Annotations.description }}{{ end }}'
      alertmanagerSpec:
        secrets:
          - gatus-slack-webhook
    kubeStateMetrics:
      enabled: true
    nodeExporter:
      enabled: true