apps/base/artifactapi/kustomization.yaml

@@ -18,4 +18,5 @@ resources:
   - ui-hpa.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
+  - vmpodscrape.yaml
   - vpa.yaml

apps/base/artifactapi/redis-deployment.yaml

@@ -53,4 +53,18 @@ spec:
             periodSeconds: 10
             successThreshold: 1
             timeoutSeconds: 5
+        - name: metrics-exporter
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/oliver006/redis_exporter:v1.89.0
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 9121
+              name: metrics
+              protocol: TCP
+          resources:
+            limits:
+              cpu: 100m
+              memory: 64Mi
+            requests:
+              cpu: 25m
+              memory: 32Mi
       restartPolicy: Always

apps/base/artifactapi/vmpodscrape.yaml

@@ -0,0 +1,16 @@
+---
+# Scrape the redis_exporter sidecar (:9121) on the redis pod. Picked up by the
+# observability VMAgent (selectAllByDefault). Pod-level rather than
+# VMServiceScrape because the redis Service doesn't expose the metrics port.
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMPodScrape
+metadata:
+  name: redis-exporter
+  namespace: artifactapi
+spec:
+  selector:
+    matchLabels:
+      app: redis
+  podMetricsEndpoints:
+    - port: metrics
+      path: /metrics

apps/base/authentik/kustomization.yaml

@@ -18,4 +18,5 @@ resources:
   - redis-service.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
+  - vmpodscrape.yaml
   - vpa.yaml

apps/base/authentik/redis-deployment.yaml

@@ -52,6 +52,20 @@ spec:
           volumeMounts:
             - mountPath: /data
               name: redis-data
+        - name: metrics-exporter
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/oliver006/redis_exporter:v1.89.0
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 9121
+              name: metrics
+              protocol: TCP
+          resources:
+            limits:
+              cpu: 100m
+              memory: 64Mi
+            requests:
+              cpu: 25m
+              memory: 32Mi
       volumes:
         - name: redis-data
           persistentVolumeClaim:

apps/base/authentik/vmpodscrape.yaml

@@ -0,0 +1,16 @@
+---
+# Scrape the redis_exporter sidecar (:9121) on the redis pod. Picked up by the
+# observability VMAgent (selectAllByDefault). Pod-level rather than
+# VMServiceScrape because the redis Service doesn't expose the metrics port.
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMPodScrape
+metadata:
+  name: redis-exporter
+  namespace: authentik
+spec:
+  selector:
+    matchLabels:
+      app: redis
+  podMetricsEndpoints:
+    - port: metrics
+      path: /metrics

apps/base/gitea/kustomization.yaml

@@ -10,6 +10,7 @@ resources:
   - valkey-deployment.yaml
   - valkey-pvc.yaml
   - valkey-service.yaml
+  - vmpodscrape.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
   - gateway.yaml

apps/base/gitea/valkey-deployment.yaml

@@ -82,6 +82,26 @@ spec:
           volumeMounts:
             - mountPath: /data
               name: data
+        - name: metrics-exporter
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/oliver006/redis_exporter:v1.89.0
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 9121
+              name: metrics
+              protocol: TCP
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            limits:
+              cpu: 100m
+              memory: 64Mi
+            requests:
+              cpu: 25m
+              memory: 32Mi
       restartPolicy: Always
       volumes:
         - name: data

apps/base/gitea/vmpodscrape.yaml

@@ -0,0 +1,16 @@
+---
+# Scrape the redis_exporter sidecar (:9121) on the gitea-valkey pod. Picked up
+# by the observability VMAgent (selectAllByDefault). Pod-level rather than
+# VMServiceScrape because the valkey Service doesn't expose the metrics port.
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMPodScrape
+metadata:
+  name: valkey-exporter
+  namespace: gitea
+spec:
+  selector:
+    matchLabels:
+      app: gitea-valkey
+  podMetricsEndpoints:
+    - port: metrics
+      path: /metrics

apps/base/jellyfin/kustomization.yaml

@@ -21,5 +21,6 @@ resources:
   - pdb.yaml
   - service.yaml
   - valkey.yaml
+  - vmpodscrape.yaml
   - gateway.yaml
   - httproute.yaml

apps/base/jellyfin/valkey.yaml

@@ -25,8 +25,14 @@ spec:
   shards: 1
   replicas: 2
   image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/valkey/valkey:9.0.0
+  # redis_exporter sidecar (:9121, port name `metrics`) on every ValkeyNode pod;
+  # the operator manages a dedicated _exporter ACL user for it. Image overridden
+  # from the operator default (bare dockerhub oliver006/redis_exporter:v1.80.0)
+  # to the artifactapi-proxied pin. Scraped by the valkey-exporter VMPodScrape
+  # in vmpodscrape.yaml alongside this file.
   exporter:
-    enabled: false
+    enabled: true
+    image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/oliver006/redis_exporter:v1.89.0
   scheduling:
     node:
       spread:

apps/base/jellyfin/vmpodscrape.yaml

@@ -0,0 +1,19 @@
+---
+# Scrape the operator-injected redis_exporter sidecar (:9121, port name
+# `metrics`) on the jellyfin-valkey ValkeyNode pods. The valkey-operator gives
+# its pods fixed labels only (no pod-label passthrough on the ValkeyCluster CR),
+# so select on the operator-managed labels. Picked up by the observability
+# VMAgent (selectAllByDefault).
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMPodScrape
+metadata:
+  name: valkey-exporter
+  namespace: jellyfin
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/managed-by: valkey-operator
+      app.kubernetes.io/component: valkey-node
+  podMetricsEndpoints:
+    - port: metrics
+      path: /metrics

apps/base/litellm/kustomization.yaml

@@ -16,6 +16,7 @@ resources:
   - services.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
+  - vmpodscrape.yaml
   - vpa.yaml
 
 configMapGenerator:

apps/base/litellm/redis-deployment.yaml

@@ -60,6 +60,20 @@ spec:
             - mountPath: /data
               mountPropagation: None
               name: data
+        - name: metrics-exporter
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/oliver006/redis_exporter:v1.89.0
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 9121
+              name: metrics
+              protocol: TCP
+          resources:
+            limits:
+              cpu: 100m
+              memory: 64Mi
+            requests:
+              cpu: 25m
+              memory: 32Mi
       restartPolicy: Always
       volumes:
         - name: data

apps/base/litellm/vmpodscrape.yaml

@@ -0,0 +1,16 @@
+---
+# Scrape the redis_exporter sidecar (:9121) on the redis pod. Picked up by the
+# observability VMAgent (selectAllByDefault). Pod-level rather than
+# VMServiceScrape because the redis Service doesn't expose the metrics port.
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMPodScrape
+metadata:
+  name: redis-exporter
+  namespace: litellm
+spec:
+  selector:
+    matchLabels:
+      app: redis
+  podMetricsEndpoints:
+    - port: metrics
+      path: /metrics

apps/base/netbox/kustomization.yaml

@@ -10,6 +10,7 @@ resources:
   - valkey-deployment.yaml
   - valkey-pvc.yaml
   - valkey-service.yaml
+  - vmpodscrape.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
   - gateway.yaml

apps/base/netbox/valkey-deployment.yaml

@@ -82,6 +82,26 @@ spec:
           volumeMounts:
             - mountPath: /data
               name: data
+        - name: metrics-exporter
+          image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/oliver006/redis_exporter:v1.89.0
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 9121
+              name: metrics
+              protocol: TCP
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            limits:
+              cpu: 100m
+              memory: 64Mi
+            requests:
+              cpu: 25m
+              memory: 32Mi
       restartPolicy: Always
       volumes:
         - name: data

apps/base/netbox/vmpodscrape.yaml

@@ -0,0 +1,16 @@
+---
+# Scrape the redis_exporter sidecar (:9121) on the netbox-valkey pod. Picked up
+# by the observability VMAgent (selectAllByDefault). Pod-level rather than
+# VMServiceScrape because the valkey Service doesn't expose the metrics port.
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMPodScrape
+metadata:
+  name: valkey-exporter
+  namespace: netbox
+spec:
+  selector:
+    matchLabels:
+      app: netbox-valkey
+  podMetricsEndpoints:
+    - port: metrics
+      path: /metrics