unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Export and scrape metrics from all redis/valkey instances (#398)

Browse Source 
## Why

No redis/valkey instance managed in this repo exports metrics today — the six caches (artifactapi, authentik, litellm, gitea, netbox, jellyfin) are blind spots in VictoriaMetrics.

## What

- Enables the valkey-operator exporter sidecar on the jellyfin ValkeyCluster (`exporter.enabled: true`); overrides the operator's default bare-dockerhub image (`oliver006/redis_exporter:v1.80.0`) with the artifactapi-proxied pin. The operator manages a dedicated `_exporter` ACL user for it.
- Adds a `metrics-exporter` sidecar (`artifactapi.k8s.syd1.au.unkin.net/dockerhub/oliver006/redis_exporter:v1.89.0`, :9121, port name `metrics`, req 32Mi/25m lim 64Mi/100m) to the five raw Deployments: artifactapi/authentik/litellm redis and gitea/netbox valkey. gitea/netbox sidecars get the same restrictive securityContext as their valkey container.
- Adds the `monitoring.unkin.net/redis-exporter: "true"` opt-in pod label to all five pod templates.
- Adds `apps/base/observability/vmpodscrape-redis.yaml` with two VMPodScrapes (any namespace, port `metrics`): `redis-exporters` selecting the opt-in label, and `valkey-operator-clusters` selecting `app.kubernetes.io/managed-by: valkey-operator` + `app.kubernetes.io/component: valkey-node` — the ValkeyCluster CR has no pod-label passthrough (verified against the v0.5.0 CRD/source), so operator pods cannot carry the opt-in label.

## Notes

- No instance runs with `requirepass`/auth, so no REDIS_PASSWORD wiring is needed on the raw Deployments; the jellyfin exporter auth is operator-managed.
- Validated: `kustomize build` on every touched base + au-syd1 overlay (helm overlays with `--enable-helm`) and `kubeconform -strict -ignore-missing-schemas` (68 valid, 0 invalid).

Reviewed-on: #398
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
This commit was merged in pull request #398.
This commit is contained in:
Unkin Agent
2026-08-23 19:19:16 +10:00
committed by BenVincent
parent 08a3493097
commit 13a04a6ebc
18 changed files with 194 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/base/artifactapi/kustomization.yaml
+1
View File
@@ -18,4 +18,5 @@ resources:
- ui-hpa.yaml
- vaultauth.yaml
- vaultstaticsecret.yaml
- vmpodscrape.yaml
- vpa.yaml
apps/base/artifactapi/redis-deployment.yaml
+14
View File
@@ -53,4 +53,18 @@ spec:
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 5
- name: metrics-exporter
image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/oliver006/redis_exporter:v1.89.0
imagePullPolicy: IfNotPresent
ports:
- containerPort: 9121
name: metrics
protocol: TCP
resources:
limits:
cpu: 100m
memory: 64Mi
requests:
cpu: 25m
memory: 32Mi
restartPolicy: Always
apps/base/artifactapi/vmpodscrape.yaml
+16
View File
@@ -0,0 +1,16 @@
---
# Scrape the redis_exporter sidecar (:9121) on the redis pod. Picked up by the
# observability VMAgent (selectAllByDefault). Pod-level rather than
# VMServiceScrape because the redis Service doesn't expose the metrics port.
apiVersion: operator.victoriametrics.com/v1beta1
kind: VMPodScrape
metadata:
name: redis-exporter
namespace: artifactapi
spec:
selector:
matchLabels:
app: redis
podMetricsEndpoints:
- port: metrics
path: /metrics
apps/base/authentik/kustomization.yaml
+1
View File
@@ -18,4 +18,5 @@ resources:
- redis-service.yaml
- vaultauth.yaml
- vaultstaticsecret.yaml
- vmpodscrape.yaml
- vpa.yaml
apps/base/authentik/redis-deployment.yaml
+14
View File
@@ -52,6 +52,20 @@ spec:
volumeMounts:
- mountPath: /data
name: redis-data
- name: metrics-exporter
image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/oliver006/redis_exporter:v1.89.0
imagePullPolicy: IfNotPresent
ports:
- containerPort: 9121
name: metrics
protocol: TCP
resources:
limits:
cpu: 100m
memory: 64Mi
requests:
cpu: 25m
memory: 32Mi
volumes:
- name: redis-data
persistentVolumeClaim:
apps/base/authentik/vmpodscrape.yaml
+16
View File
@@ -0,0 +1,16 @@
---
# Scrape the redis_exporter sidecar (:9121) on the redis pod. Picked up by the
# observability VMAgent (selectAllByDefault). Pod-level rather than
# VMServiceScrape because the redis Service doesn't expose the metrics port.
apiVersion: operator.victoriametrics.com/v1beta1
kind: VMPodScrape
metadata:
name: redis-exporter
namespace: authentik
spec:
selector:
matchLabels:
app: redis
podMetricsEndpoints:
- port: metrics
path: /metrics
apps/base/gitea/kustomization.yaml
+1
View File
@@ -10,6 +10,7 @@ resources:
- valkey-deployment.yaml
- valkey-pvc.yaml
- valkey-service.yaml
- vmpodscrape.yaml
- vaultauth.yaml
- vaultstaticsecret.yaml
- gateway.yaml
apps/base/gitea/valkey-deployment.yaml
+20
View File
@@ -82,6 +82,26 @@ spec:
volumeMounts:
- mountPath: /data
name: data
- name: metrics-exporter
image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/oliver006/redis_exporter:v1.89.0
imagePullPolicy: IfNotPresent
ports:
- containerPort: 9121
name: metrics
protocol: TCP
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
capabilities:
drop:
- ALL
resources:
limits:
cpu: 100m
memory: 64Mi
requests:
cpu: 25m
memory: 32Mi
restartPolicy: Always
volumes:
- name: data
apps/base/gitea/vmpodscrape.yaml
+16
View File
@@ -0,0 +1,16 @@
---
# Scrape the redis_exporter sidecar (:9121) on the gitea-valkey pod. Picked up
# by the observability VMAgent (selectAllByDefault). Pod-level rather than
# VMServiceScrape because the valkey Service doesn't expose the metrics port.
apiVersion: operator.victoriametrics.com/v1beta1
kind: VMPodScrape
metadata:
name: valkey-exporter
namespace: gitea
spec:
selector:
matchLabels:
app: gitea-valkey
podMetricsEndpoints:
- port: metrics
path: /metrics
apps/base/jellyfin/kustomization.yaml
+1
View File
@@ -21,5 +21,6 @@ resources:
- pdb.yaml
- service.yaml
- valkey.yaml
- vmpodscrape.yaml
- gateway.yaml
- httproute.yaml
apps/base/jellyfin/valkey.yaml
+7 -1
View File
@@ -25,8 +25,14 @@ spec:
shards: 1
replicas: 2
image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/valkey/valkey:9.0.0
# redis_exporter sidecar (:9121, port name `metrics`) on every ValkeyNode pod;
# the operator manages a dedicated _exporter ACL user for it. Image overridden
# from the operator default (bare dockerhub oliver006/redis_exporter:v1.80.0)
# to the artifactapi-proxied pin. Scraped by the valkey-exporter VMPodScrape
# in vmpodscrape.yaml alongside this file.
exporter:
enabled: false
enabled: true
image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/oliver006/redis_exporter:v1.89.0
scheduling:
node:
spread:
apps/base/jellyfin/vmpodscrape.yaml
+19
View File
@@ -0,0 +1,19 @@
---
# Scrape the operator-injected redis_exporter sidecar (:9121, port name
# `metrics`) on the jellyfin-valkey ValkeyNode pods. The valkey-operator gives
# its pods fixed labels only (no pod-label passthrough on the ValkeyCluster CR),
# so select on the operator-managed labels. Picked up by the observability
# VMAgent (selectAllByDefault).
apiVersion: operator.victoriametrics.com/v1beta1
kind: VMPodScrape
metadata:
name: valkey-exporter
namespace: jellyfin
spec:
selector:
matchLabels:
app.kubernetes.io/managed-by: valkey-operator
app.kubernetes.io/component: valkey-node
podMetricsEndpoints:
- port: metrics
path: /metrics
apps/base/litellm/kustomization.yaml
+1
View File
@@ -16,6 +16,7 @@ resources:
- services.yaml
- vaultauth.yaml
- vaultstaticsecret.yaml
- vmpodscrape.yaml
- vpa.yaml
configMapGenerator:
apps/base/litellm/redis-deployment.yaml
+14
View File
@@ -60,6 +60,20 @@ spec:
- mountPath: /data
mountPropagation: None
name: data
- name: metrics-exporter
image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/oliver006/redis_exporter:v1.89.0
imagePullPolicy: IfNotPresent
ports:
- containerPort: 9121
name: metrics
protocol: TCP
resources:
limits:
cpu: 100m
memory: 64Mi
requests:
cpu: 25m
memory: 32Mi
restartPolicy: Always
volumes:
- name: data
apps/base/litellm/vmpodscrape.yaml
+16
View File
@@ -0,0 +1,16 @@
---
# Scrape the redis_exporter sidecar (:9121) on the redis pod. Picked up by the
# observability VMAgent (selectAllByDefault). Pod-level rather than
# VMServiceScrape because the redis Service doesn't expose the metrics port.
apiVersion: operator.victoriametrics.com/v1beta1
kind: VMPodScrape
metadata:
name: redis-exporter
namespace: litellm
spec:
selector:
matchLabels:
app: redis
podMetricsEndpoints:
- port: metrics
path: /metrics
apps/base/netbox/kustomization.yaml
+1
View File
@@ -10,6 +10,7 @@ resources:
- valkey-deployment.yaml
- valkey-pvc.yaml
- valkey-service.yaml
- vmpodscrape.yaml
- vaultauth.yaml
- vaultstaticsecret.yaml
- gateway.yaml
apps/base/netbox/valkey-deployment.yaml
+20
View File
@@ -82,6 +82,26 @@ spec:
volumeMounts:
- mountPath: /data
name: data
- name: metrics-exporter
image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/oliver006/redis_exporter:v1.89.0
imagePullPolicy: IfNotPresent
ports:
- containerPort: 9121
name: metrics
protocol: TCP
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
capabilities:
drop:
- ALL
resources:
limits:
cpu: 100m
memory: 64Mi
requests:
cpu: 25m
memory: 32Mi
restartPolicy: Always
volumes:
- name: data
apps/base/netbox/vmpodscrape.yaml
+16
View File
@@ -0,0 +1,16 @@
---
# Scrape the redis_exporter sidecar (:9121) on the netbox-valkey pod. Picked up
# by the observability VMAgent (selectAllByDefault). Pod-level rather than
# VMServiceScrape because the valkey Service doesn't expose the metrics port.
apiVersion: operator.victoriametrics.com/v1beta1
kind: VMPodScrape
metadata:
name: valkey-exporter
namespace: netbox
spec:
selector:
matchLabels:
app: netbox-valkey
podMetricsEndpoints:
- port: metrics
path: /metrics