unkin-agent
b3d202b8fa
Sonarr and radarr currently expose no Prometheus metrics, so queue depth, indexer health, and library stats are invisible to the observability stack. This adds the standard exportarr exporter as a sidecar to both Deployments. - Adds an exportarr sidecar (ghcr.io/onedr0p/exportarr v2.3.0, pulled through the artifactapi `ghcr` remote, which already whitelists `^onedr0p/`) to the sonarr and radarr Deployments - Points each exporter at its local replica via env (`URL=http://localhost:8989/sonarr` / `:7878/radarr`, matching the apps' UrlBase) and reuses the existing VSO-synced API-key Secrets (`sonarr-apikey`/`radarr-apikey`, key `apitoken`) via `APIKEY` secretKeyRef — no key in argv - Serves metrics on 9707 (sonarr) / 9708 (radarr) with `/healthz` liveness+readiness probes and small resources (25m/32Mi requests, 100m/128Mi limits) - Adds per-app VMPodScrape objects (picked up by the observability VMAgent, selectAllByDefault); pod-level rather than VMServiceScrape because the app Services don't expose the metrics port Validated with `kustomize build apps/base/arrstack` + kubeconform (0 invalid). Note: with 3 replicas per app, each pod's exporter reports the same shared-Postgres-backed stats, so series are duplicated across the `pod` label; dashboards should aggregate with `max` or filter to one pod. Reviewed-on: #395 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
243 lines
8.2 KiB
YAML
243 lines
8.2 KiB
YAML
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: radarr
|
|
namespace: arrstack
|
|
spec:
|
|
# Active-active: the -unkin2 fork keeps all state in the shared Postgres
|
|
# (arrstack-postgres) and coordinates via Postgres advisory locks, so N
|
|
# replicas run concurrently behind the radarr Service. RollingUpdate is safe —
|
|
# no SQLite, no RWO lock.
|
|
replicas: 3
|
|
strategy:
|
|
type: RollingUpdate
|
|
selector:
|
|
matchLabels:
|
|
app: radarr
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: radarr
|
|
spec:
|
|
securityContext:
|
|
# Fork image has no USER (runs as root by default); pin it to a non-root
|
|
# UID and group-write the shared RWX CephFS /config (MediaCover etc.).
|
|
# OnRootMismatch avoids a recursive chown of the whole media tree.
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
fsGroup: 1000
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
initContainers:
|
|
# Gate the app on its own Postgres database+role being reachable, instead
|
|
# of relying on ArgoCD sync-waves (which deadlock if apps aren't Healthy).
|
|
# waitfordb reads the PG* env as a libpq fallback, so the password never lands in argv.
|
|
- name: wait-for-db
|
|
image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/waitfordb:v0.1.0
|
|
env:
|
|
- name: WAITFORDB_TIMEOUT
|
|
value: 5m
|
|
- name: WAITFORDB_SSLMODE
|
|
value: disable
|
|
- name: PGHOST
|
|
value: arrstack-postgres-rw.arrstack.svc.cluster.local
|
|
- name: PGPORT
|
|
value: "5432"
|
|
- name: PGDATABASE
|
|
value: radarr-main
|
|
- name: PGUSER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: radarr-db
|
|
key: username
|
|
- name: PGPASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: radarr-db
|
|
key: password
|
|
resources:
|
|
requests:
|
|
cpu: 10m
|
|
memory: 32Mi
|
|
limits:
|
|
cpu: 100m
|
|
memory: 64Mi
|
|
containers:
|
|
- name: radarr
|
|
image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/radarr:v6.4.2-unkin5
|
|
imagePullPolicy: IfNotPresent
|
|
command:
|
|
- /app/Radarr
|
|
args:
|
|
- -nobrowser
|
|
- -data=/config
|
|
# Required: bypass the single-instance guard so multiple replicas
|
|
# can share one /config. Cross-replica safety is the Postgres layer,
|
|
# not a local lock file.
|
|
- -nosingleinstancecheck
|
|
ports:
|
|
- name: http
|
|
containerPort: 7878
|
|
protocol: TCP
|
|
envFrom:
|
|
- configMapRef:
|
|
name: radarr-env
|
|
env:
|
|
- name: Radarr__Postgres__User
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: radarr-db
|
|
key: username
|
|
- name: Radarr__Postgres__Password
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: radarr-db
|
|
key: password
|
|
- name: Radarr__Auth__ApiKey
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: radarr-apikey
|
|
key: apitoken
|
|
# MediaCover object store (shared Ceph RGW bucket). Serves posters/fanart
|
|
# from S3 so any replica can render them instead of the leader-local
|
|
# emptyDir /config. Consumed by the -unkin3+ image; older images ignore
|
|
# these unknown config keys. Creds Secret is minted by cephrgw-operator.
|
|
- name: Radarr__MediaCover__S3__Endpoint
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: arrstack-media-s3
|
|
key: S3_ENDPOINT
|
|
- name: Radarr__MediaCover__S3__AccessKey
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: arrstack-media-s3
|
|
key: AWS_ACCESS_KEY_ID
|
|
- name: Radarr__MediaCover__S3__SecretKey
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: arrstack-media-s3
|
|
key: AWS_SECRET_ACCESS_KEY
|
|
- name: Radarr__MediaCover__S3__Bucket
|
|
value: arrstack-media
|
|
- name: Radarr__MediaCover__S3__Prefix
|
|
value: radarr
|
|
- name: Radarr__MediaCover__S3__ForcePathStyle
|
|
value: "true"
|
|
- name: Radarr__MediaCover__S3__CaCertPath
|
|
value: /etc/ssl/vault-ca/ca.crt
|
|
# Backup object store (shared arrstack-backups Ceph RGW bucket,
|
|
# per-app key prefix). Routes the periodic config+DB zip backups off
|
|
# the ephemeral /config so any replica can write and restore them.
|
|
- name: Radarr__BackupS3__Endpoint
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: arrstack-backups-s3
|
|
key: S3_ENDPOINT
|
|
- name: Radarr__BackupS3__AccessKey
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: arrstack-backups-s3
|
|
key: AWS_ACCESS_KEY_ID
|
|
- name: Radarr__BackupS3__SecretKey
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: arrstack-backups-s3
|
|
key: AWS_SECRET_ACCESS_KEY
|
|
- name: Radarr__BackupS3__Bucket
|
|
value: arrstack-backups
|
|
- name: Radarr__BackupS3__Prefix
|
|
value: radarr
|
|
- name: Radarr__BackupS3__ForcePathStyle
|
|
value: "true"
|
|
- name: Radarr__BackupS3__CaCertPath
|
|
value: /etc/ssl/vault-ca/ca.crt
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /radarr/ping
|
|
port: http
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /radarr/ping
|
|
port: http
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 1Gi
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /config
|
|
- name: media-movies
|
|
mountPath: /media/movies
|
|
- name: vault-ca
|
|
mountPath: /etc/ssl/vault-ca
|
|
readOnly: true
|
|
# exportarr sidecar: polls the local replica's API and exposes Prometheus
|
|
# metrics on :9708 (scraped by the radarr-exportarr VMPodScrape).
|
|
- name: exportarr
|
|
image: artifactapi.k8s.syd1.au.unkin.net/ghcr/onedr0p/exportarr:v2.3.0
|
|
imagePullPolicy: IfNotPresent
|
|
args:
|
|
- radarr
|
|
env:
|
|
- name: PORT
|
|
value: "9708"
|
|
# URL includes the /radarr UrlBase (Radarr__Server__UrlBase).
|
|
- name: URL
|
|
value: http://localhost:7878/radarr
|
|
- name: APIKEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: radarr-apikey
|
|
key: apitoken
|
|
ports:
|
|
- name: metrics
|
|
containerPort: 9708
|
|
protocol: TCP
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: metrics
|
|
initialDelaySeconds: 15
|
|
periodSeconds: 30
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: metrics
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
resources:
|
|
requests:
|
|
cpu: 25m
|
|
memory: 32Mi
|
|
limits:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
volumes:
|
|
- name: config
|
|
emptyDir: {}
|
|
- name: media-movies
|
|
persistentVolumeClaim:
|
|
claimName: media-movies
|
|
# Estate CA for validating the Ceph RGW (s3.ceph.unkin.net) TLS cert.
|
|
- name: vault-ca
|
|
secret:
|
|
secretName: vault-ca-cert
|
|
items:
|
|
- key: ca.crt
|
|
path: ca.crt
|