kube-prometheus-stack.yaml

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: kube-prometheus-stack
  finalizers:
    - resources-finalizer.argocd.argoproj.io
spec:
  project: default
  source:
    repoURL: https://prometheus-community.github.io/helm-charts
    chart: kube-prometheus-stack
    targetRevision: '*'
    helm:
      values: |
        kubeEtcd:
          service:
            enabled: true
            targetPort: 2381
        kubeProxy:
          enabled: false
        defaultRules:
          create: true
          rules:
            kubeProxy: false
        alertmanager:
          ingress:
            enabled: true
            annotations:
              kubernetes.io/ingress.class: nginx
              cert-manager.io/cluster-issuer: ca-issuer
            hosts:
              - alertmanager.kind.cluster
            tls:
              - secretName: alertmanager.kind.cluster
                hosts:
                  - alertmanager.kind.cluster
        prometheus:
          ingress:
            enabled: true
            annotations:
              kubernetes.io/ingress.class: nginx
              cert-manager.io/cluster-issuer: ca-issuer
            hosts:
              - prometheus.kind.cluster
            tls:
              - secretName: prometheus.kind.cluster
                hosts:
                  - prometheus.kind.cluster
        grafana:
          enabled: true
          adminPassword: admin
          extraVolumeMounts:
            - name: opt-ca-certificates
              mountPath: /opt/ca-certificates
              readOnly: true
              hostPath: /opt/ca-certificates
              hostPathType: Directory
          sidecar:
            enableUniqueFilenames: true
            dashboards:
              enabled: true
              searchNamespace: ALL
              provider:
                foldersFromFilesStructure: true
            datasources:
              enabled: true
              searchNamespace: ALL
          grafana.ini:
            server:
              root_url: https://grafana.kind.cluster
            auth.generic_oauth:
              enabled: true
              name: Keycloak
              allow_sign_up: true
              scopes: profile,email,groups
              auth_url: https://keycloak.kind.cluster/auth/realms/master/protocol/openid-connect/auth
              token_url: https://keycloak.kind.cluster/auth/realms/master/protocol/openid-connect/token
              api_url: https://keycloak.kind.cluster/auth/realms/master/protocol/openid-connect/userinfo
              client_id: grafana
              client_secret: grafana-client-secret
              role_attribute_path: contains(groups[*], 'grafana-admin') && 'Admin' || contains(groups[*], 'grafana-dev') && 'Editor' || 'Viewer'
          ingress:
            enabled: true
            annotations:
              kubernetes.io/ingress.class: nginx
              cert-manager.io/cluster-issuer: ca-issuer
            hosts:
              - grafana.kind.cluster
            tls:
              - secretName: grafana.kind.cluster
                hosts:
                  - grafana.kind.cluster
  destination:
    server: https://kubernetes.default.svc
    namespace: monitoring
  revisionHistoryLimit: 3
  syncPolicy:
    syncOptions:
      - ApplyOutOfSyncOnly=true
      - CreateNamespace=true
      - FailOnSharedResource=true
      - PruneLast=true
      - Replace=true
    automated:
      prune: true
      selfHeal: true