unkin-agent
74354e847d
The node scrape jobs labelmapped every node label (~50+ NFD labels) onto each series, exceeding vminsert's 40-label default so 100% of kubelet and cadvisor series were silently dropped (vm_rows_ignored_total reason=too_many_labels). kube-state-metrics, VMAlert and the kube-prometheus k8s.rules recording rules were also absent, so dashboard queries like node_namespace_pod_container:container_cpu_usage_seconds_total:sum_irate had no producer. - replaces the blanket node labelmap with a single node-name relabel - renames node jobs so series carry job=kubelet (+ metrics_path) matching kube-prometheus selectors - adds kube-state-metrics (v2.20.0 via artifactapi k8s-registry remote) with RBAC, Service and VMServiceScrape - adds VMAlert wired to vmselect/vminsert, recording rules only - adds VMRule with the kube-prometheus k8s.rules recording group
argocd-apps docs
Operational notes for the manifests in this repo.
| Doc | What it covers |
|---|---|
| cnpg-backups.md | How CNPG Postgres backups (WAL archiving + nightly base backups) to Ceph RGW are configured. |
| cnpg-restore.md | Restoring a CNPG cluster: full recovery, point-in-time recovery, cutover, and gotchas. |
| authentik-rancher-sso.md | Manual runtime step to point Rancher's OIDC auth at the canonical identity.unkin.net issuer and trust the internal CA. |
| gitea-migration.md | Staged cutover of the git.unkin.net forge from the Puppet VM to the gitea namespace. |
| ca-rotation.md | Rolling the internal unkin.net PKI CA (vault-ca-cert): what Reloader restarts automatically vs. manual/CNPG restarts. |