unkin-agent
ba71bd1a35
## Why Both traefik instances (traefik-internal/traefik-external, chart 40.0.0, image v3.7.0) already expose prometheus metrics on container port `metrics` (9100), but nothing scrapes them — VictoriaMetrics has no traefik series (verified empty). The observability VMAgent runs with selectAllByDefault and consumes VM*Scrape CRs only, so a VMPodScrape is all that is needed. ## Changes - Adds `apps/base/observability/vmpodscrape-traefik.yaml`: scrapes port `metrics` /metrics on `app.kubernetes.io/name: traefik` pods in traefik-system, relabeling `app.kubernetes.io/instance` to a stable `traefik_instance` label to split internal vs external series - Registers the new CR in the observability base kustomization - Enables `metrics.prometheus.addEntryPointsLabels` and `addRoutersLabels` in both au-syd1 traefik values files for per-entrypoint/per-route dashboards (pods restart on rollout — acceptable) Validated with `kustomize build` (observability base + overlay, traefik-system overlay with --enable-helm) and kubeconform (unknown CRDs skipped); rendered deployments carry the new metric flags and the VMPodScrape renders in the overlay. Reviewed-on: #397 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
116 lines
2.2 KiB
YAML
116 lines
2.2 KiB
YAML
image:
|
|
tag: v3.7.0
|
|
|
|
|
|
podDisruptionBudget:
|
|
enabled: true
|
|
maxUnavailable: 1
|
|
|
|
gateway:
|
|
enabled: false
|
|
|
|
gatewayClass:
|
|
enabled: false
|
|
|
|
updateStrategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxUnavailable: 1
|
|
|
|
providers:
|
|
kubernetesCRD:
|
|
enabled: false
|
|
kubernetesIngress:
|
|
enabled: false
|
|
kubernetesGateway:
|
|
enabled: true
|
|
experimentalChannel: false
|
|
namespaces: []
|
|
nativeLBByDefault: false
|
|
labelSelector: "traefik.io/instance=internal"
|
|
|
|
metrics:
|
|
prometheus:
|
|
addEntryPointsLabels: true
|
|
addRoutersLabels: true
|
|
|
|
logs:
|
|
access:
|
|
enabled: true
|
|
# JSON access logs so the logging aggregator's traefik_parse transform can
|
|
# extract route/service/status/duration/host/client_ip structured fields
|
|
# (apps/base/logging/vector/aggregator.yaml).
|
|
format: json
|
|
|
|
global:
|
|
checkNewVersion: true
|
|
sendAnonymousUsage: false
|
|
notAppendXForwardedFor: false
|
|
|
|
service:
|
|
enabled: true
|
|
single: true
|
|
annotations:
|
|
purelb.io/service-group: "common"
|
|
purelb.io/addresses: 198.18.200.4
|
|
annotationsTCP: {}
|
|
annotationsUDP: {}
|
|
labels: {}
|
|
spec:
|
|
type: LoadBalancer
|
|
loadBalancerIP: "198.18.200.4"
|
|
additionalServices: {}
|
|
|
|
autoscaling:
|
|
enabled: true
|
|
minReplicas: 2
|
|
maxReplicas: 5
|
|
metrics: []
|
|
behavior: {}
|
|
scaleTargetRef:
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
name: "{{ template \"traefik.fullname\" . }}"
|
|
|
|
persistence:
|
|
enabled: false
|
|
|
|
affinity:
|
|
podAntiAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
- labelSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: '{{ template "traefik.name" . }}'
|
|
app.kubernetes.io/instance: '{{ .Release.Name }}-{{ include "traefik.namespace" . }}'
|
|
topologyKey: kubernetes.io/hostname
|
|
|
|
podSecurityContext:
|
|
runAsGroup: 65532
|
|
runAsNonRoot: true
|
|
runAsUser: 65532
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: [ALL]
|
|
add: [NET_BIND_SERVICE]
|
|
readOnlyRootFilesystem: true
|
|
|
|
ports:
|
|
web:
|
|
port: 80
|
|
websecure:
|
|
port: 443
|
|
vault-direct:
|
|
port: 8200
|
|
ldaps:
|
|
port: 636
|
|
exposedPort: 636
|
|
expose:
|
|
default: true
|
|
protocol: TCP
|
|
|
|
enabled: true
|