Movses AslanyanandClaude Opus 5.5
b3e7c14958
czy publishes no service ports, so Traefik exposes each service's :9464 as https://ledgerline.vione.cloud/metrics/<service> behind basic auth, and the platform's Prometheus gets a `ledgerline` job with one target per service. The targets share an address; a `service` label tells them apart, and relabels derive __metrics_path__ and instance from it. create-secrets.sh now also creates the prometheus-scrape-auth secret (mounted optional, so a missing secret fails only this job) and writes the gitignored htpasswd file Traefik reads, which is copied to czy like .env.observability. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
71 lines
2.1 KiB
YAML
71 lines
2.1 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: prometheus
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app: prometheus
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: prometheus
|
|
spec:
|
|
containers:
|
|
- name: prometheus
|
|
image: prom/prometheus:v3.5.0
|
|
args:
|
|
- --config.file=/etc/prometheus/prometheus.yml
|
|
- --storage.tsdb.path=/prometheus
|
|
- --storage.tsdb.retention.time=15d
|
|
- --web.enable-lifecycle
|
|
- --web.enable-remote-write-receiver
|
|
# Not in the Ansible template. Without it Prometheus discards the
|
|
# exemplars Tempo's metrics-generator remote-writes
|
|
# (send_exemplars: true), so the datasource's
|
|
# exemplarTraceIdDestinations has nothing to link.
|
|
- --enable-feature=exemplar-storage
|
|
ports:
|
|
- containerPort: 9090
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /-/ready
|
|
port: 9090
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 256Mi
|
|
limits:
|
|
memory: 1Gi
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /etc/prometheus/prometheus.yml
|
|
subPath: prometheus.yml
|
|
- name: rules
|
|
mountPath: /etc/prometheus/rules
|
|
- name: data
|
|
mountPath: /prometheus
|
|
- name: scrape-auth
|
|
mountPath: /etc/prometheus/secrets
|
|
readOnly: true
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: prometheus-config
|
|
- name: rules
|
|
configMap:
|
|
name: prometheus-rules
|
|
- name: data
|
|
persistentVolumeClaim:
|
|
claimName: prometheus-data
|
|
# Basic-auth credentials for the `ledgerline` scrape job, created by
|
|
# create-secrets.sh. Optional so a missing secret costs that job's
|
|
# scrapes (up == 0) rather than the whole Prometheus pod.
|
|
- name: scrape-auth
|
|
secret:
|
|
secretName: prometheus-scrape-auth
|
|
optional: true
|