arrstack: add exportarr metrics sidecars to sonarr and radarr (#395)

Sonarr and radarr currently expose no Prometheus metrics, so queue depth, indexer health, and library stats are invisible to the observability stack. This adds the standard exportarr exporter as a sidecar to both Deployments.

- Adds an exportarr sidecar (ghcr.io/onedr0p/exportarr v2.3.0, pulled through the artifactapi `ghcr` remote, which already whitelists `^onedr0p/`) to the sonarr and radarr Deployments
- Points each exporter at its local replica via env (`URL=http://localhost:8989/sonarr` / `:7878/radarr`, matching the apps' UrlBase) and reuses the existing VSO-synced API-key Secrets (`sonarr-apikey`/`radarr-apikey`, key `apitoken`) via `APIKEY` secretKeyRef — no key in argv
- Serves metrics on 9707 (sonarr) / 9708 (radarr) with `/healthz` liveness+readiness probes and small resources (25m/32Mi requests, 100m/128Mi limits)
- Adds per-app VMPodScrape objects (picked up by the observability VMAgent, selectAllByDefault); pod-level rather than VMServiceScrape because the app Services don't expose the metrics port

Validated with `kustomize build apps/base/arrstack` + kubeconform (0 invalid).

Note: with 3 replicas per app, each pod's exporter reports the same shared-Postgres-backed stats, so series are duplicated across the `pod` label; dashboards should aggregate with `max` or filter to one pod.
Reviewed-on: #395
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

apps/base/arrstack/radarr/deployment.yaml

@@ -182,6 +182,51 @@ spec:
             - name: vault-ca
               mountPath: /etc/ssl/vault-ca
               readOnly: true
+        # exportarr sidecar: polls the local replica's API and exposes Prometheus
+        # metrics on :9708 (scraped by the radarr-exportarr VMPodScrape).
+        - name: exportarr
+          image: artifactapi.k8s.syd1.au.unkin.net/ghcr/onedr0p/exportarr:v2.3.0
+          imagePullPolicy: IfNotPresent
+          args:
+            - radarr
+          env:
+            - name: PORT
+              value: "9708"
+            # URL includes the /radarr UrlBase (Radarr__Server__UrlBase).
+            - name: URL
+              value: http://localhost:7878/radarr
+            - name: APIKEY
+              valueFrom:
+                secretKeyRef:
+                  name: radarr-apikey
+                  key: apitoken
+          ports:
+            - name: metrics
+              containerPort: 9708
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: metrics
+            initialDelaySeconds: 15
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: metrics
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 25m
+              memory: 32Mi
+            limits:
+              cpu: 100m
+              memory: 128Mi
       volumes:
         - name: config
           emptyDir: {}

apps/base/arrstack/radarr/kustomization.yaml

@@ -9,3 +9,4 @@ resources:
   - service.yaml
   - gateway.yaml
   - httproute.yaml
+  - vmpodscrape.yaml

apps/base/arrstack/radarr/vmpodscrape.yaml

@@ -0,0 +1,16 @@
+---
+# Scrape the exportarr sidecar (:9708) on every radarr pod. Picked up by the
+# observability VMAgent (selectAllByDefault). Pod-level rather than
+# VMServiceScrape because the radarr Service doesn't expose the metrics port.
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMPodScrape
+metadata:
+  name: radarr-exportarr
+  namespace: arrstack
+spec:
+  selector:
+    matchLabels:
+      app: radarr
+  podMetricsEndpoints:
+    - port: metrics
+      path: /metrics

apps/base/arrstack/sonarr/deployment.yaml

@@ -184,6 +184,51 @@ spec:
             - name: vault-ca
               mountPath: /etc/ssl/vault-ca
               readOnly: true
+        # exportarr sidecar: polls the local replica's API and exposes Prometheus
+        # metrics on :9707 (scraped by the sonarr-exportarr VMPodScrape).
+        - name: exportarr
+          image: artifactapi.k8s.syd1.au.unkin.net/ghcr/onedr0p/exportarr:v2.3.0
+          imagePullPolicy: IfNotPresent
+          args:
+            - sonarr
+          env:
+            - name: PORT
+              value: "9707"
+            # URL includes the /sonarr UrlBase (Sonarr__Server__UrlBase).
+            - name: URL
+              value: http://localhost:8989/sonarr
+            - name: APIKEY
+              valueFrom:
+                secretKeyRef:
+                  name: sonarr-apikey
+                  key: apitoken
+          ports:
+            - name: metrics
+              containerPort: 9707
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: metrics
+            initialDelaySeconds: 15
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: metrics
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 25m
+              memory: 32Mi
+            limits:
+              cpu: 100m
+              memory: 128Mi
       volumes:
         - name: config
           emptyDir: {}

apps/base/arrstack/sonarr/kustomization.yaml

@@ -9,3 +9,4 @@ resources:
   - service.yaml
   - gateway.yaml
   - httproute.yaml
+  - vmpodscrape.yaml

apps/base/arrstack/sonarr/vmpodscrape.yaml

@@ -0,0 +1,16 @@
+---
+# Scrape the exportarr sidecar (:9707) on every sonarr pod. Picked up by the
+# observability VMAgent (selectAllByDefault). Pod-level rather than
+# VMServiceScrape because the sonarr Service doesn't expose the metrics port.
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMPodScrape
+metadata:
+  name: sonarr-exportarr
+  namespace: arrstack
+spec:
+  selector:
+    matchLabels:
+      app: sonarr
+  podMetricsEndpoints:
+    - port: metrics
+      path: /metrics