unkin-agent
9b154d38f4
Per review: drop the cross-namespace label-selector approach. Each app now carries its own VMPodScrape next to its redis/valkey manifests, selecting on the deployment's existing pod labels (mirroring the arrstack exportarr pattern), so no opt-in monitoring.unkin.net/redis-exporter label is needed. - Remove the monitoring.unkin.net/redis-exporter pod label from the artifactapi/authentik/litellm redis and gitea/netbox valkey deployments - Delete apps/base/observability/vmpodscrape-redis.yaml - Add a local-namespace VMPodScrape (port metrics, path /metrics) to artifactapi, authentik, litellm (app=redis), gitea (app=gitea-valkey), netbox (app=netbox-valkey), and jellyfin (valkey-operator node labels)
52 lines
1.9 KiB
YAML
52 lines
1.9 KiB
YAML
---
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
resources:
|
|
- cnpg_cluster.yaml
|
|
- cnpg_backup.yaml
|
|
- cnpg_pooler.yaml
|
|
- deployment.yaml
|
|
- hpa.yaml
|
|
- gateway.yaml
|
|
- httproute.yaml
|
|
- namespace.yaml
|
|
- redis-deployment.yaml
|
|
- redis-pvc.yaml
|
|
- services.yaml
|
|
- vaultauth.yaml
|
|
- vaultstaticsecret.yaml
|
|
- vmpodscrape.yaml
|
|
- vpa.yaml
|
|
|
|
configMapGenerator:
|
|
- name: litellm-config
|
|
files:
|
|
- config.yaml=resources/config.yaml
|
|
options:
|
|
disableNameSuffixHash: true
|
|
- name: litellm-env
|
|
literals:
|
|
- STORE_MODEL_IN_DB=True
|
|
# Emit structured JSON logs so the Tier-2 vector litellm pipeline can parse
|
|
# model/tokens/latency/key/status (logs.k8s.litellm.*).
|
|
- JSON_LOGS=True
|
|
# Authentik OIDC SSO (generic). Client secret is injected from the
|
|
# oauth-credentials Secret in the Deployment; endpoints match the other
|
|
# apps (identity.unkin.net). PROXY_BASE_URL is required for SSO.
|
|
- GENERIC_CLIENT_ID=litellm
|
|
- GENERIC_AUTHORIZATION_ENDPOINT=https://identity.unkin.net/application/o/authorize/
|
|
- GENERIC_TOKEN_ENDPOINT=https://identity.unkin.net/application/o/token/
|
|
- GENERIC_USERINFO_ENDPOINT=https://identity.unkin.net/application/o/userinfo/
|
|
# litellm_role scope carries the Authentik-computed role claim; LiteLLM
|
|
# reads it via GENERIC_USER_ROLE_ATTRIBUTE and maps to proxy_admin/etc.
|
|
- GENERIC_SCOPE=openid email profile litellm_role
|
|
- GENERIC_USER_ROLE_ATTRIBUTE=litellm_role
|
|
- PROXY_BASE_URL=https://litellm.k8s.syd1.au.unkin.net
|
|
# Trust the internal unkin.net CA (identity.unkin.net) via the combined
|
|
# bundle assembled by the combine-certs init container.
|
|
- SSL_CERT_FILE=/etc/ssl/combined/ca-certificates.crt
|
|
- REQUESTS_CA_BUNDLE=/etc/ssl/combined/ca-certificates.crt
|
|
options:
|
|
disableNameSuffixHash: true
|