feat: separate vmetrics setup for data pipeline

[bo0tzz]

No description provided.

[github-actions]

--- kubernetes/apps Kustomization: flux-system/cluster-apps Namespace: flux-system/data

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Namespace: flux-system/data

@@ -0,0 +1,9 @@

+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster-apps
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: data
+
--- kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/data-pipeline-vmetrics

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/data-pipeline-vmetrics

@@ -0,0 +1,25 @@

+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster-apps
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: data-pipeline-vmetrics
+  namespace: flux-system
+spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: data-pipeline-vmetrics
+  dependsOn:
+  - name: grafana-operator
+  interval: 30m
+  path: ./kubernetes/apps/pipelines/data/victoria-metrics/app
+  prune: true
+  retryInterval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: immich-kubernetes
+  timeout: 5m
+  wait: true
+
--- kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/data-pipeline-ingress

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/data-pipeline-ingress

@@ -0,0 +1,25 @@

+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster-apps
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: data-pipeline-ingress
+  namespace: flux-system
+spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: data-pipeline-ingress
+  dependsOn:
+  - name: data-pipeline-vmetrics
+  interval: 30m
+  path: ./kubernetes/apps/pipelines/data/victoria-metrics/ingress
+  prune: true
+  retryInterval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: immich-kubernetes
+  timeout: 5m
+  wait: true
+
--- kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/data-pipeline-grafana-secrets

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/data-pipeline-grafana-secrets

@@ -0,0 +1,25 @@

+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster-apps
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: data-pipeline-grafana-secrets
+  namespace: flux-system
+spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: data-pipeline-grafana-secrets
+  dependsOn:
+  - name: cluster-apps-onepassword
+  interval: 30m
+  path: ./kubernetes/apps/pipelines/data/grafana/secrets
+  prune: true
+  retryInterval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: immich-kubernetes
+  timeout: 5m
+  wait: true
+
--- kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/data-pipeline-grafana

+++ kubernetes/apps Kustomization: flux-system/cluster-apps Kustomization: flux-system/data-pipeline-grafana

@@ -0,0 +1,31 @@

+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: cluster-apps
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: data-pipeline-grafana
+  namespace: flux-system
+spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: data-pipeline-grafana
+  dependsOn:
+  - name: grafana-operator
+  - name: data-pipeline-vmetrics
+  - name: data-pipeline-grafana-secrets
+  interval: 30m
+  path: ./kubernetes/apps/pipelines/data/grafana/app
+  postBuild:
+    substituteFrom:
+    - kind: Secret
+      name: data-pipeline-grafana-oauth
+  prune: true
+  retryInterval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: immich-kubernetes
+  timeout: 5m
+  wait: true
+
--- kubernetes/apps/authentication/dexidp/app Kustomization: flux-system/dexidp HelmRelease: authentication/dex

+++ kubernetes/apps/authentication/dexidp/app Kustomization: flux-system/dexidp HelmRelease: authentication/dex

@@ -63,12 +63,13 @@

         - /device/callback
       - id: grafana
         name: grafana
         redirectURIs:
         - https://monitoring.immich.cloud/login/generic_oauth
         - https://monitoring.dev.immich.cloud/login/generic_oauth
+        - https://grafana.data.immich.cloud/login/generic_oauth
         secretEnv: GRAFANA_OAUTH_CLIENT_SECRET
       - id: outline
         name: outline
         redirectURIs:
         - https://outline.immich.cloud/auth/oidc.callback
         secretEnv: OIDC_CLIENT_SECRET
--- kubernetes/apps/pipelines/data/grafana/secrets Kustomization: flux-system/data-pipeline-grafana-secrets OnePasswordItem: flux-system/data-pipeline-grafana-oauth

+++ kubernetes/apps/pipelines/data/grafana/secrets Kustomization: flux-system/data-pipeline-grafana-secrets OnePasswordItem: flux-system/data-pipeline-grafana-oauth

@@ -0,0 +1,13 @@

+---
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  labels:
+    app.kubernetes.io/name: data-pipeline-grafana-secrets
+    kustomize.toolkit.fluxcd.io/name: data-pipeline-grafana-secrets
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: data-pipeline-grafana-oauth
+  namespace: flux-system
+spec:
+  itemPath: vaults/Kubernetes/items/grafana-oauth-client-secret
+
--- kubernetes/apps/pipelines/data/grafana/secrets Kustomization: flux-system/data-pipeline-grafana-secrets OnePasswordItem: data/grafana-admin-credentials

+++ kubernetes/apps/pipelines/data/grafana/secrets Kustomization: flux-system/data-pipeline-grafana-secrets OnePasswordItem: data/grafana-admin-credentials

@@ -0,0 +1,13 @@

+---
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  labels:
+    app.kubernetes.io/name: data-pipeline-grafana-secrets
+    kustomize.toolkit.fluxcd.io/name: data-pipeline-grafana-secrets
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: grafana-admin-credentials
+  namespace: data
+spec:
+  itemPath: vaults/Kubernetes/items/grafana-admin-credentials
+
--- kubernetes/apps/pipelines/data/victoria-metrics/app Kustomization: flux-system/data-pipeline-vmetrics HelmRelease: data/victoria-metrics

+++ kubernetes/apps/pipelines/data/victoria-metrics/app Kustomization: flux-system/data-pipeline-vmetrics HelmRelease: data/victoria-metrics

@@ -0,0 +1,74 @@

+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  labels:
+    app.kubernetes.io/name: data-pipeline-vmetrics
+    kustomize.toolkit.fluxcd.io/name: data-pipeline-vmetrics
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: victoria-metrics
+  namespace: data
+spec:
+  chart:
+    spec:
+      chart: victoria-metrics-k8s-stack
+      interval: 15m
+      sourceRef:
+        kind: HelmRepository
+        name: victoria-metrics
+        namespace: flux-system
+      version: 0.33.2
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  interval: 5m
+  maxHistory: 2
+  uninstall:
+    keepHistory: false
+  upgrade:
+    cleanupOnFail: true
+    crds: CreateReplace
+    remediation:
+      retries: 3
+  values:
+    alertmanager:
+      enabled: false
+    coreDns:
+      enabled: false
+    crds:
+      enabled: false
+    defaultDashboards:
+      enabled: false
+    defaultRules:
+      create: false
+    fullnameOverride: vmetrics-data
+    grafana:
+      enabled: false
+    kube-state-metrics:
+      enabled: false
+    kubeControllerManager:
+      enabled: false
+    kubeEtcd:
+      enabled: false
+    kubeScheduler:
+      enabled: false
+    kubelet:
+      enabled: false
+    prometheus-node-exporter:
+      enabled: false
+    victoria-metrics-operator:
+      enabled: false
+    vmalert:
+      enabled: false
+    vmsingle:
+      spec:
+        extraArgs:
+          search.maxUniqueTimeseries: '600000'
+        resources: {}
+        retentionPeriod: 50y
+        storage:
+          resources:
+            requests:
+              storage: 500Gi
+
--- kubernetes/apps/pipelines/data/victoria-metrics/ingress Kustomization: flux-system/data-pipeline-ingress VMAuth: data/data-ingress

+++ kubernetes/apps/pipelines/data/victoria-metrics/ingress Kustomization: flux-system/data-pipeline-ingress VMAuth: data/data-ingress

@@ -0,0 +1,24 @@

+---
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMAuth
+metadata:
+  labels:
+    app.kubernetes.io/name: data-pipeline-ingress
+    kustomize.toolkit.fluxcd.io/name: data-pipeline-ingress
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: data-ingress
+  namespace: data
+spec:
+  ingress:
+    annotations:
+      cert-manager.io/cluster-issuer: letsencrypt-production
+    class_name: nginx
+    tlsHosts:
+    - data.immich.cloud
+    tlsSecretName: vmetrics-tls
+  selectAllByDefault: true
+  userNamespaceSelector:
+    matchLabels:
+      kubernetes.io/metadata.name: data
+  userSelector: {}
+
--- kubernetes/apps/pipelines/data/victoria-metrics/ingress Kustomization: flux-system/data-pipeline-ingress OnePasswordItem: data/data-write-token

+++ kubernetes/apps/pipelines/data/victoria-metrics/ingress Kustomization: flux-system/data-pipeline-ingress OnePasswordItem: data/data-write-token

@@ -0,0 +1,13 @@

+---
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  labels:
+    app.kubernetes.io/name: data-pipeline-ingress
+    kustomize.toolkit.fluxcd.io/name: data-pipeline-ingress
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: data-write-token
+  namespace: data
+spec:
+  itemPath: vaults/Kubernetes/items/vmetrics_data_write_token
+
--- kubernetes/apps/pipelines/data/victoria-metrics/ingress Kustomization: flux-system/data-pipeline-ingress VMUser: data/write

+++ kubernetes/apps/pipelines/data/victoria-metrics/ingress Kustomization: flux-system/data-pipeline-ingress VMUser: data/write

@@ -0,0 +1,22 @@

+---
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMUser
+metadata:
+  labels:
+    app.kubernetes.io/name: data-pipeline-ingress
+    kustomize.toolkit.fluxcd.io/name: data-pipeline-ingress
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: write
+  namespace: data
+spec:
+  targetRefs:
+  - crd:
+      kind: VMSingle
+      name: vmetrics-data
+      namespace: data
+    paths:
+    - /write
+  tokenRef:
+    key: token
+    name: data-write-token
+
--- kubernetes/apps/pipelines/data/victoria-metrics/ingress Kustomization: flux-system/data-pipeline-ingress OnePasswordItem: data/data-read-token

+++ kubernetes/apps/pipelines/data/victoria-metrics/ingress Kustomization: flux-system/data-pipeline-ingress OnePasswordItem: data/data-read-token

@@ -0,0 +1,13 @@

+---
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  labels:
+    app.kubernetes.io/name: data-pipeline-ingress
+    kustomize.toolkit.fluxcd.io/name: data-pipeline-ingress
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: data-read-token
+  namespace: data
+spec:
+  itemPath: vaults/Kubernetes/items/vmetrics_data_read_token
+
--- kubernetes/apps/pipelines/data/victoria-metrics/ingress Kustomization: flux-system/data-pipeline-ingress VMUser: data/read

+++ kubernetes/apps/pipelines/data/victoria-metrics/ingress Kustomization: flux-system/data-pipeline-ingress VMUser: data/read

@@ -0,0 +1,25 @@

+---
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMUser
+metadata:
+  labels:
+    app.kubernetes.io/name: data-pipeline-ingress
+    kustomize.toolkit.fluxcd.io/name: data-pipeline-ingress
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: read
+  namespace: data
+spec:
+  targetRefs:
+  - crd:
+      kind: VMSingle
+      name: vmetrics-data
+      namespace: data
+    paths:
+    - /api/v1/query
+    - /api/v1/query_range
+    - /api/v1/series
+    - /api/v1/labels
+  tokenRef:
+    key: token
+    name: data-read-token
+
--- kubernetes/apps/pipelines/data/victoria-metrics/ingress Kustomization: flux-system/data-pipeline-ingress OnePasswordItem: data/data-admin-token

+++ kubernetes/apps/pipelines/data/victoria-metrics/ingress Kustomization: flux-system/data-pipeline-ingress OnePasswordItem: data/data-admin-token

@@ -0,0 +1,13 @@

+---
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  labels:
+    app.kubernetes.io/name: data-pipeline-ingress
+    kustomize.toolkit.fluxcd.io/name: data-pipeline-ingress
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: data-admin-token
+  namespace: data
+spec:
+  itemPath: vaults/Kubernetes/items/vmetrics_data_admin_token
+
--- kubernetes/apps/pipelines/data/victoria-metrics/ingress Kustomization: flux-system/data-pipeline-ingress VMUser: data/admin

+++ kubernetes/apps/pipelines/data/victoria-metrics/ingress Kustomization: flux-system/data-pipeline-ingress VMUser: data/admin

@@ -0,0 +1,23 @@

+---
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMUser
+metadata:
+  labels:
+    app.kubernetes.io/name: data-pipeline-ingress
+    kustomize.toolkit.fluxcd.io/name: data-pipeline-ingress
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+    vm-user: admin
+  name: admin
+  namespace: data
+spec:
+  targetRefs:
+  - crd:
+      kind: VMSingle
+      name: vmetrics-data
+      namespace: data
+    paths:
+    - /api/v1/admin.*
+  tokenRef:
+    key: token
+    name: data-admin-token
+
--- kubernetes/apps/pipelines/data/grafana/app Kustomization: flux-system/data-pipeline-grafana GrafanaDatasource: data/victoria-metrics

+++ kubernetes/apps/pipelines/data/grafana/app Kustomization: flux-system/data-pipeline-grafana GrafanaDatasource: data/victoria-metrics

@@ -0,0 +1,21 @@

+---
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDatasource
+metadata:
+  labels:
+    app.kubernetes.io/name: data-pipeline-grafana
+    kustomize.toolkit.fluxcd.io/name: data-pipeline-grafana
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: victoria-metrics
+  namespace: data
+spec:
+  datasource:
+    access: proxy
+    isDefault: true
+    name: victoria-metrics
+    type: prometheus
+    url: http://vmsingle-vmetrics-data:8429
+  instanceSelector:
+    matchLabels:
+      dashboards: grafana
+
--- kubernetes/apps/pipelines/data/grafana/app Kustomization: flux-system/data-pipeline-grafana Grafana: data/grafana

+++ kubernetes/apps/pipelines/data/grafana/app Kustomization: flux-system/data-pipeline-grafana Grafana: data/grafana

@@ -0,0 +1,71 @@

+---
+apiVersion: grafana.integreatly.org/v1beta1
+kind: Grafana
+metadata:
+  labels:
+    app.kubernetes.io/name: data-pipeline-grafana
+    dashboards: grafana
+    kustomize.toolkit.fluxcd.io/name: data-pipeline-grafana
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: grafana
+  namespace: data
+spec:
+  config:
+    auth.generic_oauth:
+      allow_assign_grafana_admin: 'true'
+      api_url: https://auth.immich.cloud/userinfo
+      auth_url: https://auth.immich.cloud/auth
+      auto_login: 'true'
+      client_id: grafana
+      client_secret: ${GRAFANA_OAUTH_CLIENT_SECRET}
+      enabled: 'true'
+      role_attribute_path: contains(groups[*], 'immich-app:Admins') && 'GrafanaAdmin'
+        || 'Viewer'
+      scopes: openid email profile groups offline_access
+      token_url: https://auth.immich.cloud/token
+    server:
+      root_url: https://grafana.data.immich.cloud/
+    users:
+      viewers_can_edit: 'true'
+  deployment:
+    spec:
+      template:
+        metadata:
+          labels:
+            dashboards: grafana
+        spec:
+          securityContext:
+            fsGroup: 472
+          volumes:
+          - name: grafana-data
+            persistentVolumeClaim:
+              claimName: grafana-pvc
+  ingress:
+    metadata:
+      annotations:
+        cert-manager.io/cluster-issuer: letsencrypt-production
+    spec:
+      ingressClassName: nginx
+      rules:
+      - host: grafana.data.immich.cloud
+        http:
+          paths:
+          - backend:
+              service:
+                name: grafana-service
+                port:
+                  number: 3000
+            path: /
+            pathType: Prefix
+      tls:
+      - hosts:
+        - grafana.data.immich.cloud
+        secretName: grafana-tls-secret
+  persistentVolumeClaim:
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 20Gi
+

[github-actions]

--- HelmRelease: data/victoria-metrics VMAgent: data/vmetrics-data

+++ HelmRelease: data/victoria-metrics VMAgent: data/vmetrics-data

@@ -0,0 +1,25 @@

+---
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMAgent
+metadata:
+  name: vmetrics-data
+  namespace: data
+  labels:
+    app.kubernetes.io/component: victoria-metrics-k8s-stack-vmagent
+    app.kubernetes.io/instance: victoria-metrics
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: victoria-metrics-k8s-stack
+spec:
+  externalLabels: {}
+  extraArgs:
+    promscrape.dropOriginalLabels: 'true'
+    promscrape.streamParse: 'true'
+  image:
+    tag: v1.108.1
+  license: {}
+  port: '8429'
+  remoteWrite:
+  - url: http://vmsingle-vmetrics-data.data.svc.cluster.local.:8429/api/v1/write
+  scrapeInterval: 20s
+  selectAllByDefault: true
+
--- HelmRelease: data/victoria-metrics VMServiceScrape: data/vmetrics-data-kube-api-server

+++ HelmRelease: data/victoria-metrics VMServiceScrape: data/vmetrics-data-kube-api-server

@@ -0,0 +1,27 @@

+---
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMServiceScrape
+metadata:
+  name: vmetrics-data-kube-api-server
+  namespace: data
+  labels:
+    app.kubernetes.io/instance: victoria-metrics
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: victoria-metrics-k8s-stack
+spec:
+  endpoints:
+  - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+    port: https
+    scheme: https
+    tlsConfig:
+      caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+      serverName: kubernetes
+  jobLabel: component
+  namespaceSelector:
+    matchNames:
+    - default
+  selector:
+    matchLabels:
+      component: apiserver
+      provider: kubernetes
+
--- HelmRelease: data/victoria-metrics VMSingle: data/vmetrics-data

+++ HelmRelease: data/victoria-metrics VMSingle: data/vmetrics-data

@@ -0,0 +1,28 @@

+---
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMSingle
+metadata:
+  name: vmetrics-data
+  namespace: data
+  labels:
+    app.kubernetes.io/component: victoria-metrics-k8s-stack-vmsingle
+    app.kubernetes.io/instance: victoria-metrics
+    app.kubernetes.io/managed-by: Helm
+    app.kubernetes.io/name: victoria-metrics-k8s-stack
+spec:
+  extraArgs:
+    search.maxUniqueTimeseries: '600000'
+  image:
+    tag: v1.108.1
+  license: {}
+  port: '8429'
+  replicaCount: 1
+  resources: {}
+  retentionPeriod: 50y
+  storage:
+    accessModes:
+    - ReadWriteOnce
+    resources:
+      requests:
+        storage: 500Gi
+