kube-prometheus-stack:
  nameOverride: observability-prometheus
  prometheusOperator:
    admissionWebhooks:
      certManager:
        enabled: true
#        issuerRef:
#          name: "lets-encrypt"
#          kind: "ClusterIssuer"
  prometheus-node-exporter:
    hostRootFsMount:
      mountPropagation: None

  alertmanager:
    enabled: true
  grafana:
    enabled: true
    envFromSecret: prometheus
    grafana.ini:
      server:
        root_url: https://grafana.k8s.monitoring.2martens.de
      auth.generic_oauth:
        enabled: true
        name: Keycloak-OAuth
        allow_sign_up: true
        client_id: ${GF_AUTH_GENERIC_OAUTH_CLIENT_ID}
        client_secret: ${GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET}
        scopes: openid email profile offline_access roles
        email_attribute_path: email
        login_attribute_path: username
        name_attribute_path: full_name
        auth_url: https://id.2martens.de/realms/twomartens/protocol/openid-connect/auth
        token_url: https://id.2martens.de/realms/twomartens/protocol/openid-connect/token
        api_url: https://id.2martens.de/realms/twomartens/protocol/openid-connect/userinfo
        role_attribute_path: contains(resource_access."grafana-oauth".roles, 'admin') && 'Admin' || contains(resource_access."grafana-oauth".roles, 'editor') && 'Editor' || 'Viewer'
    ingress:
      enabled: true
      ingressClassName: public
      annotations:
        cert-manager.io/cluster-issuer: lets-encrypt
        ingress.kubernetes.io/rewrite-target: /
      hosts:
        - grafana.k8s.monitoring.2martens.de
      tls:
        - secretName: grafana-general-tls
          hosts:
            - grafana.k8s.monitoring.2martens.de

  prometheus:
    prometheusSpec:
      retention: 6h
      disableCompaction: true
      storageSpec:
        volumeClaimTemplate:
          spec:
            storageClassName: hcloud-volumes
            accessModes: [ "ReadWriteOnce" ]
            resources:
              requests:
                storage: 10Gi
      thanos:
        objectStorageConfig:
          existingSecret:
            key: thanos.yaml
            name: thanos-object-storage-config
    ingress:
      enabled: false
    thanosServiceMonitor:
      enabled: true
    thanosService:
      enabled: true
  kubeControllerManager:
    endpoints:
      - 10.0.0.7
  kubeScheduler:
    endpoints:
      - 10.0.0.7
storage:
  handles:
    - "100341703"
vault:
  enabled: true
  applicationName: prometheus