unkin-agent
13a04a6ebc
## Why No redis/valkey instance managed in this repo exports metrics today — the six caches (artifactapi, authentik, litellm, gitea, netbox, jellyfin) are blind spots in VictoriaMetrics. ## What - Enables the valkey-operator exporter sidecar on the jellyfin ValkeyCluster (`exporter.enabled: true`); overrides the operator's default bare-dockerhub image (`oliver006/redis_exporter:v1.80.0`) with the artifactapi-proxied pin. The operator manages a dedicated `_exporter` ACL user for it. - Adds a `metrics-exporter` sidecar (`artifactapi.k8s.syd1.au.unkin.net/dockerhub/oliver006/redis_exporter:v1.89.0`, :9121, port name `metrics`, req 32Mi/25m lim 64Mi/100m) to the five raw Deployments: artifactapi/authentik/litellm redis and gitea/netbox valkey. gitea/netbox sidecars get the same restrictive securityContext as their valkey container. - Adds the `monitoring.unkin.net/redis-exporter: "true"` opt-in pod label to all five pod templates. - Adds `apps/base/observability/vmpodscrape-redis.yaml` with two VMPodScrapes (any namespace, port `metrics`): `redis-exporters` selecting the opt-in label, and `valkey-operator-clusters` selecting `app.kubernetes.io/managed-by: valkey-operator` + `app.kubernetes.io/component: valkey-node` — the ValkeyCluster CR has no pod-label passthrough (verified against the v0.5.0 CRD/source), so operator pods cannot carry the opt-in label. ## Notes - No instance runs with `requirepass`/auth, so no REDIS_PASSWORD wiring is needed on the raw Deployments; the jellyfin exporter auth is operator-managed. - Validated: `kustomize build` on every touched base + au-syd1 overlay (helm overlays with `--enable-helm`) and `kubeconform -strict -ignore-missing-schemas` (68 valid, 0 invalid). Reviewed-on: #398 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
110 lines
3.1 KiB
YAML
110 lines
3.1 KiB
YAML
---
|
|
# Standalone Valkey (Redis-compatible) for NetBox. The netbox-community chart
|
|
# bundles a Bitnami Valkey subchart, but we run our own here: it keeps image
|
|
# control in-estate (valkey/valkey, already allowlisted through the artifactapi
|
|
# dockerhub mirror), avoids the Bitnami "legacy image" churn, and matches the
|
|
# standalone-cache pattern used by litellm. One instance serves both NetBox
|
|
# databases: DB 0 = RQ task queue, DB 1 = cache. AOF persistence is enabled so
|
|
# queued background jobs survive a restart.
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: netbox-valkey
|
|
namespace: netbox
|
|
labels:
|
|
app.kubernetes.io/name: netbox
|
|
app.kubernetes.io/component: valkey
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: netbox-valkey
|
|
strategy:
|
|
type: Recreate
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: netbox-valkey
|
|
app.kubernetes.io/name: netbox
|
|
app.kubernetes.io/component: valkey
|
|
spec:
|
|
securityContext:
|
|
fsGroup: 999
|
|
containers:
|
|
- name: valkey
|
|
image: valkey/valkey:8-alpine
|
|
imagePullPolicy: IfNotPresent
|
|
command:
|
|
- valkey-server
|
|
- --appendonly
|
|
- "yes"
|
|
- --save
|
|
- "60"
|
|
- "1"
|
|
ports:
|
|
- containerPort: 6379
|
|
name: valkey
|
|
protocol: TCP
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
runAsNonRoot: true
|
|
runAsUser: 999
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
livenessProbe:
|
|
exec:
|
|
command:
|
|
- valkey-cli
|
|
- ping
|
|
failureThreshold: 3
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
successThreshold: 1
|
|
timeoutSeconds: 5
|
|
readinessProbe:
|
|
exec:
|
|
command:
|
|
- valkey-cli
|
|
- ping
|
|
failureThreshold: 3
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
successThreshold: 1
|
|
timeoutSeconds: 5
|
|
resources:
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
requests:
|
|
cpu: 50m
|
|
memory: 128Mi
|
|
volumeMounts:
|
|
- mountPath: /data
|
|
name: data
|
|
- name: metrics-exporter
|
|
image: artifactapi.k8s.syd1.au.unkin.net/dockerhub/oliver006/redis_exporter:v1.89.0
|
|
imagePullPolicy: IfNotPresent
|
|
ports:
|
|
- containerPort: 9121
|
|
name: metrics
|
|
protocol: TCP
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
runAsNonRoot: true
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
resources:
|
|
limits:
|
|
cpu: 100m
|
|
memory: 64Mi
|
|
requests:
|
|
cpu: 25m
|
|
memory: 32Mi
|
|
restartPolicy: Always
|
|
volumes:
|
|
- name: data
|
|
persistentVolumeClaim:
|
|
claimName: netbox-valkey-data
|