ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/victoriametrics/agentgateway-scrape.yaml

@@ -0,0 +1,44 @@
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMServiceScrape
+metadata:
+  name: agentgateway
+  namespace: victoriametrics
+  labels:
+    observability.quorate.internal/scrape: "true"
+spec:
+  namespaceSelector:
+    matchNames:
+      - agentgateway-system
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: agentgateway-proxy
+      app.kubernetes.io/component: metrics
+  endpoints:
+    - port: metrics
+      path: /metrics
+      interval: 30s
+      scrapeTimeout: 10s
+      metricRelabelConfigs:
+        - action: labeldrop
+          regex: "(?i)(.*password.*|.*passwd.*|.*secret.*|.*auth.*|.*bearer.*|.*cookie.*|.*dsn.*|.*uri.*|.*url.*|.*cmdline.*|.*command.*|.*args.*|.*env.*)"
+---
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMServiceScrape
+metadata:
+  name: agentgateway-model-costs
+  namespace: victoriametrics
+  labels:
+    observability.quorate.internal/scrape: "true"
+spec:
+  namespaceSelector:
+    matchNames:
+      - agentgateway-system
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: model-catalog
+      app.kubernetes.io/component: metrics
+  endpoints:
+    - port: metrics
+      path: /metrics
+      interval: 5m
+      scrapeTimeout: 10s

vendor/platform/victoriametrics/auth.yaml

@@ -0,0 +1,97 @@
+---
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMAuth
+metadata:
+  name: main
+  namespace: victoriametrics
+spec:
+  image:
+    tag: v1.155.0
+  replicaCount: 2
+  podDisruptionBudget:
+    minAvailable: 1
+  affinity:
+    podAntiAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        - labelSelector:
+            matchLabels:
+              app.kubernetes.io/instance: main
+              app.kubernetes.io/name: vmauth
+          topologyKey: kubernetes.io/hostname
+  useStrictSecurity: true
+  userNamespaceSelector:
+    matchLabels:
+      kubernetes.io/metadata.name: victoriametrics
+  userSelector:
+    matchLabels:
+      app.kubernetes.io/part-of: victoriametrics
+    matchExpressions:
+      - key: app.kubernetes.io/component
+        operator: In
+        values:
+          - ingest-auth
+          - query-auth
+  resources:
+    requests:
+      cpu: 2m
+      memory: 64Mi
+    limits:
+      memory: 512Mi
+---
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMUser
+metadata:
+  name: query
+  namespace: victoriametrics
+  labels:
+    app.kubernetes.io/component: query-auth
+    app.kubernetes.io/part-of: victoriametrics
+spec:
+  name: query
+  tokenRef:
+    name: vmauth-query-token
+    key: token
+  targetRefs:
+    - static:
+        url: http://vmselect-main.victoriametrics.svc.cluster.local:8481/select/0
+      paths:
+        - /prometheus/.*
+---
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMUser
+metadata:
+  name: logs-query
+  namespace: victoriametrics
+  labels:
+    app.kubernetes.io/component: query-auth
+    app.kubernetes.io/part-of: victoriametrics
+spec:
+  name: logs-query
+  tokenRef:
+    name: vmauth-logs-query-token
+    key: token
+  targetRefs:
+    - static:
+        url: http://vlselect-main.victorialogs.svc.cluster.local:9471
+      paths:
+        - /select/logsql/.*
+        - /select/tenant_ids
+---
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMUser
+metadata:
+  name: relay-ingest
+  namespace: victoriametrics
+  labels:
+    app.kubernetes.io/component: ingest-auth
+    app.kubernetes.io/part-of: victoriametrics
+spec:
+  name: relay-ingest
+  tokenRef:
+    name: vmauth-relay-ingest-token
+    key: token
+  targetRefs:
+    - static:
+        url: http://vlinsert-main.victorialogs.svc.cluster.local:9481
+      paths:
+        - /insert/native.*

vendor/platform/victoriametrics/cnpg-scrape.yaml

@@ -0,0 +1,116 @@
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMPodScrape
+metadata:
+  name: cnpg
+  namespace: victoriametrics
+  labels:
+    observability.quorate.internal/scrape: 'true'
+spec:
+  namespaceSelector:
+    matchNames:
+      - postgres
+  selector:
+    matchLabels:
+      cnpg.io/cluster: main
+  podMetricsEndpoints:
+    - port: metrics
+      path: /metrics
+      interval: 30s
+      scrapeTimeout: 10s
+      metricRelabelConfigs:
+        - action: labeldrop
+          regex: (?i)(.*password.*|.*passwd.*|.*secret.*|.*token.*|.*auth.*|.*bearer.*|.*cookie.*|.*dsn.*|.*uri.*|.*url.*|.*cmdline.*|.*command.*|.*args.*|.*env.*)
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: cnpg-metrics
+  namespace: postgres
+spec:
+  endpointSelector:
+    matchLabels:
+      cnpg.io/cluster: main
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: victoriametrics
+            app.kubernetes.io/name: vmagent
+            app.kubernetes.io/instance: main
+      toPorts:
+        - ports:
+            - port: '9187'
+              protocol: TCP
+---
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMPodScrape
+metadata:
+  name: cnpg-operator
+  namespace: victoriametrics
+  labels:
+    observability.quorate.internal/scrape: 'true'
+spec:
+  namespaceSelector:
+    matchNames:
+      - postgres
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: cloudnative-pg
+      app.kubernetes.io/instance: cnpg
+  podMetricsEndpoints:
+    - port: metrics
+      path: /metrics
+      interval: 30s
+      scrapeTimeout: 10s
+      metricRelabelConfigs:
+        - action: labeldrop
+          regex: (?i)(.*password.*|.*passwd.*|.*secret.*|.*token.*|.*auth.*|.*bearer.*|.*cookie.*|.*dsn.*|.*uri.*|.*url.*|.*cmdline.*|.*command.*|.*args.*|.*env.*)
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: cnpg-operator-metrics
+  namespace: postgres
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: cloudnative-pg
+      app.kubernetes.io/instance: cnpg
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: victoriametrics
+            app.kubernetes.io/name: vmagent
+            app.kubernetes.io/instance: main
+      toPorts:
+        - ports:
+            - port: '8080'
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: vmagent-cnpg
+  namespace: victoriametrics
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: vmagent
+      app.kubernetes.io/instance: main
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: postgres
+            cnpg.io/cluster: main
+      toPorts:
+        - ports:
+            - port: '9187'
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: postgres
+            app.kubernetes.io/name: cloudnative-pg
+            app.kubernetes.io/instance: cnpg
+      toPorts:
+        - ports:
+            - port: '8080'
+              protocol: TCP

vendor/platform/victoriametrics/dcgm-exporter-scrape.yaml

@@ -0,0 +1,33 @@
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMServiceScrape
+metadata:
+  name: dcgm-exporter
+  namespace: victoriametrics
+  labels:
+    observability.quorate.internal/scrape: "true"
+spec:
+  namespaceSelector:
+    matchNames:
+      - nvidia
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: dcgm-exporter
+      app.kubernetes.io/instance: dcgm-exporter
+  endpoints:
+    - port: metrics
+      interval: 30s
+      scrapeTimeout: 10s
+      relabelConfigs:
+        - sourceLabels:
+            - __meta_kubernetes_pod_node_name
+          targetLabel: node
+        - sourceLabels:
+            - __meta_kubernetes_pod_node_name
+          targetLabel: instance
+        - action: labeldrop
+          regex: pod|container|endpoint|uid|service|namespace|prometheus
+      metricRelabelConfigs:
+        - action: labeldrop
+          regex: pod|container|endpoint|uid|service|namespace|prometheus
+        - action: labeldrop
+          regex: "(?i)(.*password.*|.*passwd.*|.*secret.*|.*token.*|.*auth.*|.*bearer.*|.*cookie.*|.*dsn.*|.*uri.*|.*url.*|.*cmdline.*|.*command.*|.*args.*|.*env.*)"

vendor/platform/victoriametrics/dragonfly-scrape.yaml

@@ -0,0 +1,23 @@
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMServiceScrape
+metadata:
+  name: dragonfly
+  namespace: victoriametrics
+  labels:
+    observability.quorate.internal/scrape: "true"
+spec:
+  namespaceSelector:
+    matchNames:
+      - dragonfly
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: dragonfly
+      app.kubernetes.io/component: metrics
+  endpoints:
+    - port: metrics
+      path: /metrics
+      interval: 30s
+      scrapeTimeout: 10s
+      metricRelabelConfigs:
+        - action: labeldrop
+          regex: "(?i)(.*password.*|.*passwd.*|.*secret.*|.*token.*|.*auth.*|.*bearer.*|.*cookie.*|.*dsn.*|.*uri.*|.*url.*|.*cmdline.*|.*command.*|.*args.*|.*env.*)"

vendor/platform/victoriametrics/health.yaml

@@ -0,0 +1,92 @@
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMAlert
+metadata:
+  name: health
+  namespace: victoriametrics
+spec:
+  replicaCount: 2
+  image:
+    tag: v1.155.0
+  useStrictSecurity: true
+  logFormat: json
+  ruleSelector:
+    matchLabels:
+      app.kubernetes.io/part-of: cluster-health
+  datasource:
+    url: http://vmselect-main.victoriametrics.svc.cluster.local:8481/select/0/prometheus
+  remoteWrite:
+    url: http://vminsert-main.victoriametrics.svc.cluster.local:8480/insert/0/prometheus
+  extraArgs:
+    notifier.blackhole: "true"
+  podDisruptionBudget:
+    minAvailable: 1
+  affinity:
+    podAntiAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        - labelSelector:
+            matchLabels:
+              app.kubernetes.io/name: vmalert
+              app.kubernetes.io/instance: health
+          topologyKey: kubernetes.io/hostname
+  resources:
+    requests:
+      cpu: 10m
+      memory: 64Mi
+    limits:
+      memory: 128Mi
+---
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMRule
+metadata:
+  name: health-days
+  namespace: victoriametrics
+  labels:
+    app.kubernetes.io/part-of: cluster-health
+spec:
+  groups:
+    - name: health-days
+      interval: 1d
+      eval_offset: 10m
+      rules:
+        - record: node_health_day
+          expr: >-
+            label_replace(
+              avg by (node) (
+                avg_over_time(up{job="node-exporter-prometheus-node-exporter"}[1d] offset 10m)
+              ),
+              "node", "$1", "node", "ms2k-(.+)"
+            )
+        - record: public_health_day
+          expr: >-
+            WITH (
+              names = max by (namespace, service, label_health_quorate_dev_name) (
+                kube_service_labels{label_health_quorate_dev_name!=""} @ now()
+              ),
+              public = max by (namespace, service) (kube_service_labels)
+                and on (namespace, service) names,
+              slices = label_replace(
+                max by (namespace, endpointslice, label_kubernetes_io_service_name) (
+                  kube_endpointslice_labels
+                ),
+                "service", "$1", "label_kubernetes_io_service_name", "(.+)"
+              ) and on (namespace, service) public,
+              ready = max by (namespace, service) (
+                slices * on (namespace, endpointslice) group_right (service)
+                  max by (namespace, endpointslice) (
+                    kube_endpointslice_endpoints{ready="true"}
+                  )
+              ),
+              health = (ready or on (namespace, service) (0 * public))
+                and on (namespace, service) public,
+              daily = avg_over_time(health[1d:30s] offset 10m)
+                or on (namespace, service) max by (namespace, service) (
+                  last_over_time(service_health_day[1d] offset 10m)
+                )
+            )
+            label_keep(
+              label_replace(
+                daily * on (namespace, service) group_left (label_health_quorate_dev_name) names,
+                "name", "$1", "label_health_quorate_dev_name", "(.+)"
+              ),
+              "name"
+            )

vendor/platform/victoriametrics/kube-state.yaml

@@ -0,0 +1,93 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: kube-state-metrics
+  namespace: victoriametrics
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: kube-state-metrics
+      version: 8.7.1
+      sourceRef:
+        kind: HelmRepository
+        name: prometheus-community
+        namespace: flux-system
+  values:
+    fullnameOverride: kube-state-metrics
+    replicas: 2
+    metricLabelsAllowlist:
+      - services=[health.quorate.dev/name]
+      - endpointslices=[kubernetes.io/service-name]
+    resources:
+      requests:
+        cpu: 10m
+        memory: 64Mi
+      limits:
+        memory: 256Mi
+---
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMServiceScrape
+metadata:
+  name: kube-state-metrics
+  namespace: victoriametrics
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: kube-state-metrics
+  namespaceSelector:
+    matchNames: [victoriametrics]
+  endpoints:
+    - port: http
+      honorLabels: true
+  jobLabel: app.kubernetes.io/name
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: kube-state-metrics
+  namespace: victoriametrics
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: kube-state-metrics
+  ingress:
+    - fromEntities: [host]
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
+            - port: "8081"
+              protocol: TCP
+    - fromEndpoints:
+        - matchLabels:
+            app.kubernetes.io/name: vmagent
+            app.kubernetes.io/instance: main
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
+  egress:
+    - toEntities: [kube-apiserver]
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: host-kube-state
+spec:
+  nodeSelector: {}
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: victoriametrics
+            app.kubernetes.io/name: kube-state-metrics
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
+            - port: "8081"
+              protocol: TCP

vendor/platform/victoriametrics/kubelet-scrape.yaml

@@ -0,0 +1,103 @@
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMNodeScrape
+metadata:
+  name: kubelet-cadvisor
+  namespace: victoriametrics
+  labels:
+    observability.quorate.internal/scrape: "true"
+spec:
+  scheme: https
+  path: /metrics/cadvisor
+  interval: 30s
+  scrapeTimeout: 10s
+  tlsConfig:
+    caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+  bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+  relabelConfigs:
+    - sourceLabels:
+        - __meta_kubernetes_node_name
+      targetLabel: node
+    - sourceLabels:
+        - __meta_kubernetes_node_name
+      targetLabel: instance
+    - sourceLabels:
+        - __metrics_path__
+      targetLabel: metrics_path
+    - action: replace
+      targetLabel: job
+      replacement: kubelet-cadvisor
+  metricRelabelConfigs:
+    - action: labeldrop
+      regex: "(?i)(.*password.*|.*passwd.*|.*secret.*|.*token.*|.*auth.*|.*bearer.*|.*cookie.*|.*dsn.*|.*uri.*|.*url.*|.*cmdline.*|.*command.*|.*args.*|.*env.*)"
+---
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMNodeScrape
+metadata:
+  name: k3s-health
+  namespace: victoriametrics
+  labels:
+    observability.quorate.internal/scrape: "true"
+spec:
+  scheme: https
+  path: /metrics/slis
+  interval: 30s
+  scrapeTimeout: 10s
+  tlsConfig:
+    caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+  bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+  relabelConfigs:
+    - action: keep
+      sourceLabels:
+        - __meta_kubernetes_node_label_node_role_kubernetes_io_control_plane
+      regex: "true"
+    - sourceLabels:
+        - __meta_kubernetes_node_name
+      targetLabel: node
+    - sourceLabels:
+        - __meta_kubernetes_node_name
+      targetLabel: instance
+    - sourceLabels:
+        - __metrics_path__
+      targetLabel: metrics_path
+    - action: replace
+      targetLabel: job
+      replacement: k3s-health
+  metricRelabelConfigs:
+    - action: labeldrop
+      regex: "(?i)(.*password.*|.*passwd.*|.*secret.*|.*token.*|.*auth.*|.*bearer.*|.*cookie.*|.*dsn.*|.*uri.*|.*url.*|.*cmdline.*|.*command.*|.*args.*|.*env.*)"
+---
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMNodeScrape
+metadata:
+  name: kubelet-metrics
+  namespace: victoriametrics
+  labels:
+    observability.quorate.internal/scrape: "true"
+spec:
+  scheme: https
+  path: /metrics
+  interval: 30s
+  scrapeTimeout: 10s
+  tlsConfig:
+    caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+  bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+  relabelConfigs:
+    - action: drop
+      sourceLabels:
+        - __meta_kubernetes_node_label_node_role_kubernetes_io_control_plane
+      regex: "true"
+    - sourceLabels:
+        - __meta_kubernetes_node_name
+      targetLabel: node
+    - sourceLabels:
+        - __meta_kubernetes_node_name
+      targetLabel: instance
+    - sourceLabels:
+        - __metrics_path__
+      targetLabel: metrics_path
+    - action: replace
+      targetLabel: job
+      replacement: kubelet
+  metricRelabelConfigs:
+    - action: labeldrop
+      regex: "(?i)(.*password.*|.*passwd.*|.*secret.*|.*token.*|.*auth.*|.*bearer.*|.*cookie.*|.*dsn.*|.*uri.*|.*url.*|.*cmdline.*|.*command.*|.*args.*|.*env.*)"

vendor/platform/victoriametrics/kustomization.yaml

@@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - agentgateway-scrape.yaml
+  - auth.yaml
+  - cnpg-scrape.yaml
+  - dragonfly-scrape.yaml
+  - health.yaml
+  - kubelet-scrape.yaml
+  - kube-state.yaml
+  - metrics.yaml
+  - oci-l4-relay-scrape.yaml
+  - route.yaml
+  - scrapes.yaml
+  - dcgm-exporter-scrape.yaml
+  - vso.yaml
+  - network-policies.yaml

vendor/platform/victoriametrics/metrics.yaml

@@ -0,0 +1,122 @@
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMCluster
+metadata:
+  name: main
+  namespace: victoriametrics
+spec:
+  retentionPeriod: "90d"
+  replicationFactor: 2
+  useStrictSecurity: true
+  vmstorage:
+    image:
+      tag: v1.155.0-cluster
+    replicaCount: 2
+    extraArgs:
+      dedup.minScrapeInterval: 30s
+    podDisruptionBudget:
+      minAvailable: 1
+    affinity:
+      podAntiAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          - labelSelector:
+              matchLabels:
+                app.kubernetes.io/instance: main
+                app.kubernetes.io/name: vmstorage
+            topologyKey: kubernetes.io/hostname
+    storageDataPath: /vm-data
+    storage:
+      volumeClaimTemplate:
+        spec:
+          storageClassName: openebs-hostpath-hdd
+          accessModes:
+            - ReadWriteOnce
+          resources:
+            requests:
+              storage: 50Gi
+    resources:
+      requests:
+        cpu: 250m
+        memory: 1Gi
+      limits:
+        memory: 4Gi
+  vmselect:
+    image:
+      tag: v1.155.0-cluster
+    replicaCount: 2
+    extraArgs:
+      dedup.minScrapeInterval: 30s
+    podDisruptionBudget:
+      minAvailable: 1
+    affinity:
+      podAntiAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          - labelSelector:
+              matchLabels:
+                app.kubernetes.io/instance: main
+                app.kubernetes.io/name: vmselect
+            topologyKey: kubernetes.io/hostname
+    cacheMountPath: /select-cache
+    storage:
+      emptyDir:
+        sizeLimit: 5Gi
+    resources:
+      requests:
+        cpu: 100m
+        memory: 256Mi
+      limits:
+        memory: 1Gi
+  vminsert:
+    image:
+      tag: v1.155.0-cluster
+    replicaCount: 2
+    podDisruptionBudget:
+      minAvailable: 1
+    affinity:
+      podAntiAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+          - labelSelector:
+              matchLabels:
+                app.kubernetes.io/instance: main
+                app.kubernetes.io/name: vminsert
+            topologyKey: kubernetes.io/hostname
+    resources:
+      requests:
+        cpu: 100m
+        memory: 256Mi
+      limits:
+        memory: 1Gi
+---
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMAgent
+metadata:
+  name: main
+  namespace: victoriametrics
+spec:
+  image:
+    tag: v1.155.0
+  replicaCount: 2
+  externalLabelName: prometheus
+  podDisruptionBudget:
+    minAvailable: 1
+  affinity:
+    podAntiAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        - labelSelector:
+            matchLabels:
+              app.kubernetes.io/instance: main
+              app.kubernetes.io/name: vmagent
+          topologyKey: kubernetes.io/hostname
+  useStrictSecurity: true
+  selectAllByDefault: true
+  scrapeInterval: 30s
+  scrapeTimeout: 10s
+  externalLabels:
+    cluster: quorate
+  remoteWrite:
+    - url: http://vminsert-main.victoriametrics.svc.cluster.local:8480/insert/0/prometheus/api/v1/write
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      memory: 1Gi

vendor/platform/victoriametrics/network-policies.yaml

@@ -0,0 +1,342 @@
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: victoriametrics
+  namespace: victoriametrics
+spec:
+  endpointSelector:
+    matchLabels:
+      managed-by: vm-operator
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: victoriametrics
+      toPorts:
+        - ports:
+            - port: "8429"
+              protocol: TCP
+            - port: "8427"
+              protocol: TCP
+            - port: "8435"
+              protocol: TCP
+            - port: "8080"
+              protocol: TCP
+            - port: "8480"
+              protocol: TCP
+            - port: "8481"
+              protocol: TCP
+            - port: "8482"
+              protocol: TCP
+            - port: "8400"
+              protocol: TCP
+            - port: "8401"
+              protocol: TCP
+    - fromEntities:
+        - host
+      toPorts:
+        - ports:
+            - port: "8429"
+              protocol: TCP
+            - port: "8427"
+              protocol: TCP
+            - port: "8435"
+              protocol: TCP
+            - port: "8080"
+              protocol: TCP
+            - port: "8480"
+              protocol: TCP
+            - port: "8481"
+              protocol: TCP
+            - port: "8482"
+              protocol: TCP
+            - port: "8400"
+              protocol: TCP
+            - port: "8401"
+              protocol: TCP
+    - fromEntities:
+        - ingress
+      toPorts:
+        - ports:
+            - port: "8427"
+              protocol: TCP
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            gateway.networking.k8s.io/gateway-name: gateway-internal
+      toPorts:
+        - ports:
+            - port: "8427"
+              protocol: TCP
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: grafana
+            app.kubernetes.io/name: grafana
+      toPorts:
+        - ports:
+            - port: "8427"
+              protocol: TCP
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: victoriametrics
+      toPorts:
+        - ports:
+            - port: "8429"
+              protocol: TCP
+            - port: "8427"
+              protocol: TCP
+            - port: "8080"
+              protocol: TCP
+            - port: "8435"
+              protocol: TCP
+            - port: "8480"
+              protocol: TCP
+            - port: "8481"
+              protocol: TCP
+            - port: "8482"
+              protocol: TCP
+            - port: "8400"
+              protocol: TCP
+            - port: "8401"
+              protocol: TCP
+    - toEntities:
+        - kube-apiserver
+      toPorts:
+        - ports:
+            - port: "6443"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: node-exporter
+            app.kubernetes.io/name: prometheus-node-exporter
+            app.kubernetes.io/instance: node-exporter
+      toPorts:
+        - ports:
+            - port: "9100"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: smartctl-exporter
+            app.kubernetes.io/name: prometheus-smartctl-exporter
+            app.kubernetes.io/instance: smartctl-exporter
+      toPorts:
+        - ports:
+            - port: "9633"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: zfs-exporter
+            app.kubernetes.io/name: zfs-exporter
+            app.kubernetes.io/instance: zfs-exporter
+      toPorts:
+        - ports:
+            - port: "9134"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: nvidia
+            app.kubernetes.io/name: dcgm-exporter
+            app.kubernetes.io/instance: dcgm-exporter
+      toPorts:
+        - ports:
+            - port: "9400"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: victorialogs
+            managed-by: vm-operator
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: vlagent
+            app.kubernetes.io/name: vlagent
+            app.kubernetes.io/instance: main
+      toPorts:
+        - ports:
+            - port: "9429"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: gateway-internal-egress-victoriametrics
+spec:
+  endpointSelector:
+    matchLabels:
+      "reserved:ingress": ""
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: victoriametrics
+            app.kubernetes.io/name: vmauth
+            app.kubernetes.io/instance: main
+      toPorts:
+        - ports:
+            - port: "8427"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: host-egress-victoriametrics
+spec:
+  nodeSelector: {}
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: victoriametrics
+            managed-by: vm-operator
+      toPorts:
+        - ports:
+            - port: "8429"
+              protocol: TCP
+            - port: "8427"
+              protocol: TCP
+            - port: "8435"
+              protocol: TCP
+            - port: "8080"
+              protocol: TCP
+            - port: "8480"
+              protocol: TCP
+            - port: "8481"
+              protocol: TCP
+            - port: "8482"
+              protocol: TCP
+            - port: "8400"
+              protocol: TCP
+            - port: "8401"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: host-ingress-victoriametrics-replies
+spec:
+  nodeSelector: {}
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: victoriametrics
+            app.kubernetes.io/name: vmauth
+            app.kubernetes.io/instance: main
+      toPorts:
+        - ports:
+            - port: "32768"
+              endPort: 60999
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: vmagent-kubelet
+  namespace: victoriametrics
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: vmagent
+      app.kubernetes.io/instance: main
+  egress:
+    - toEntities:
+        - host
+        - remote-node
+      toPorts:
+        - ports:
+            - port: "10250"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: vmagent-egress-oci-l4-relay
+  namespace: victoriametrics
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: vmagent
+      app.kubernetes.io/instance: main
+  egress:
+    - toEntities:
+        - host
+        - remote-node
+      toPorts:
+        - ports:
+            - port: "19100"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: vmagent-egress-dragonfly
+  namespace: victoriametrics
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: vmagent
+      app.kubernetes.io/instance: main
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: dragonfly
+            app.kubernetes.io/name: dragonfly
+      toPorts:
+        - ports:
+            - port: "9999"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: vmagent-egress-longhorn-manager
+  namespace: victoriametrics
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: vmagent
+      app.kubernetes.io/instance: main
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: longhorn
+            app: longhorn-manager
+      toPorts:
+        - ports:
+            - port: "9500"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: vmagent-egress-agentgateway
+  namespace: victoriametrics
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: vmagent
+      app.kubernetes.io/instance: main
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: agentgateway-system
+            gateway.networking.k8s.io/gateway-name: agentgateway-proxy
+      toPorts:
+        - ports:
+            - port: "15020"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: agentgateway-system
+            app.kubernetes.io/name: model-catalog
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP

vendor/platform/victoriametrics/oci-l4-relay-scrape.yaml

@@ -0,0 +1,18 @@
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMStaticScrape
+metadata:
+  name: oci-l4-relay
+  namespace: victoriametrics
+  labels:
+    observability.quorate.internal/scrape: "true"
+spec:
+  jobName: oci-l4-relay
+  targetEndpoints:
+    - targets:
+        - oci-l4-relay-metrics.kube-system.svc:19100
+      path: /metrics
+      interval: 30s
+      scrapeTimeout: 10s
+      metricRelabelConfigs:
+        - action: labeldrop
+          regex: "(?i)(.*password.*|.*passwd.*|.*secret.*|.*token.*|.*auth.*|.*bearer.*|.*cookie.*|.*dsn.*|.*uri.*|.*url.*|.*cmdline.*|.*command.*|.*args.*|.*env.*)"

vendor/platform/victoriametrics/route.yaml

@@ -0,0 +1,39 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: victoriametrics
+  namespace: victoriametrics
+spec:
+  parentRefs:
+    - name: gateway-internal
+      namespace: kube-system
+      sectionName: https
+  hostnames:
+    - metrics.quorate.internal
+    - logs.quorate.internal
+  rules:
+    - backendRefs:
+        - name: vmauth-main
+          port: 8427
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: relay-log-ingest
+  namespace: victoriametrics
+spec:
+  parentRefs:
+    - name: gateway-relay
+      namespace: kube-system
+      sectionName: https
+  hostnames:
+    - relay-logs.quorate.dev
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /insert/native
+      backendRefs:
+        - name: vmauth-main
+          port: 8427

vendor/platform/victoriametrics/scrapes.yaml

@@ -0,0 +1,152 @@
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMServiceScrape
+metadata:
+  name: victoriametrics-operator
+  namespace: victoriametrics
+  labels:
+    observability.quorate.internal/scrape: "true"
+spec:
+  namespaceSelector:
+    matchNames:
+      - victoriametrics
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: victoria-metrics-operator
+      app.kubernetes.io/instance: victoriametrics-operator
+  endpoints:
+    - port: http
+      metricRelabelConfigs:
+        - action: labeldrop
+          regex: "(?i)(.*password.*|.*passwd.*|.*secret.*|.*token.*|.*auth.*|.*bearer.*|.*cookie.*|.*dsn.*|.*uri.*|.*url.*|.*cmdline.*|.*command.*|.*args.*|.*env.*)"
+---
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMServiceScrape
+metadata:
+  name: node-exporter
+  namespace: victoriametrics
+  labels:
+    observability.quorate.internal/scrape: "true"
+spec:
+  namespaceSelector:
+    matchNames:
+      - node-exporter
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: prometheus-node-exporter
+      app.kubernetes.io/instance: node-exporter
+  endpoints:
+    - port: metrics
+      interval: 30s
+      scrapeTimeout: 10s
+      relabelConfigs:
+        - sourceLabels:
+            - __meta_kubernetes_pod_node_name
+          targetLabel: node
+        - sourceLabels:
+            - __meta_kubernetes_pod_node_name
+          targetLabel: instance
+        # Series identity must track the node, not the exporter pod object.
+        - action: labeldrop
+          regex: pod|container|endpoint|uid|service|namespace|prometheus
+      metricRelabelConfigs:
+        - action: labeldrop
+          regex: pod|container|endpoint|uid|service|namespace|prometheus
+        - action: labeldrop
+          regex: "(?i)(.*password.*|.*passwd.*|.*secret.*|.*token.*|.*auth.*|.*bearer.*|.*cookie.*|.*dsn.*|.*uri.*|.*url.*|.*cmdline.*|.*command.*|.*args.*|.*env.*)"
+---
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMServiceScrape
+metadata:
+  name: longhorn
+  namespace: victoriametrics
+  labels:
+    observability.quorate.internal/scrape: "true"
+spec:
+  namespaceSelector:
+    matchNames:
+      - longhorn
+  selector:
+    matchLabels:
+      app: longhorn-manager
+  endpoints:
+    - port: manager
+      path: /metrics
+      interval: 30s
+      scrapeTimeout: 10s
+      relabelConfigs:
+        - sourceLabels:
+            - __meta_kubernetes_pod_node_name
+          targetLabel: node
+      metricRelabelConfigs:
+        - action: labeldrop
+          regex: "(?i)(.*password.*|.*passwd.*|.*secret.*|.*token.*|.*auth.*|.*bearer.*|.*cookie.*|.*dsn.*|.*uri.*|.*url.*|.*cmdline.*|.*command.*|.*args.*|.*env.*)"
+---
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMServiceScrape
+metadata:
+  name: smartctl-exporter
+  namespace: victoriametrics
+  labels:
+    observability.quorate.internal/scrape: "true"
+spec:
+  namespaceSelector:
+    matchNames:
+      - smartctl-exporter
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: prometheus-smartctl-exporter
+      app.kubernetes.io/instance: smartctl-exporter
+  endpoints:
+    - port: http
+      interval: 60s
+      scrapeTimeout: 30s
+      relabelConfigs:
+        - sourceLabels:
+            - __meta_kubernetes_pod_node_name
+          targetLabel: node
+        - sourceLabels:
+            - __meta_kubernetes_pod_node_name
+          targetLabel: instance
+        # Series identity must track the node, not the exporter pod object.
+        - action: labeldrop
+          regex: pod|container|endpoint|uid|service|namespace|prometheus
+      metricRelabelConfigs:
+        - action: labeldrop
+          regex: pod|container|endpoint|uid|service|namespace|prometheus
+        - action: labeldrop
+          regex: "(?i)(.*password.*|.*passwd.*|.*secret.*|.*token.*|.*auth.*|.*bearer.*|.*cookie.*|.*dsn.*|.*uri.*|.*url.*|.*cmdline.*|.*command.*|.*args.*|.*env.*)"
+---
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMServiceScrape
+metadata:
+  name: zfs-exporter
+  namespace: victoriametrics
+  labels:
+    observability.quorate.internal/scrape: "true"
+spec:
+  namespaceSelector:
+    matchNames:
+      - zfs-exporter
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: zfs-exporter
+      app.kubernetes.io/instance: zfs-exporter
+  endpoints:
+    - port: http
+      interval: 30s
+      scrapeTimeout: 10s
+      relabelConfigs:
+        - sourceLabels:
+            - __meta_kubernetes_pod_node_name
+          targetLabel: node
+        - sourceLabels:
+            - __meta_kubernetes_pod_node_name
+          targetLabel: instance
+        # Series identity must track the node, not the exporter pod object.
+        - action: labeldrop
+          regex: pod|container|endpoint|uid|service|namespace|prometheus
+      metricRelabelConfigs:
+        - action: labeldrop
+          regex: pod|container|endpoint|uid|service|namespace|prometheus
+        - action: labeldrop
+          regex: "(?i)(.*password.*|.*passwd.*|.*secret.*|.*token.*|.*auth.*|.*bearer.*|.*cookie.*|.*dsn.*|.*uri.*|.*url.*|.*cmdline.*|.*command.*|.*args.*|.*env.*)"

vendor/platform/victoriametrics/vso.yaml

@@ -0,0 +1,64 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: victoriametrics-vso
+  namespace: victoriametrics
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: victoriametrics
+spec:
+  method: kubernetes
+  mount: kubernetes
+  kubernetes:
+    role: victoriametrics
+    serviceAccount: victoriametrics-vso
+  vaultConnectionRef: vault/vault
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: vmauth-query-token
+  namespace: victoriametrics
+spec:
+  type: kv-v2
+  mount: secret
+  path: victoriametrics/vmauth/query
+  destination:
+    name: vmauth-query-token
+    create: true
+  refreshAfter: 1h
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: vmauth-logs-query-token
+  namespace: victoriametrics
+spec:
+  type: kv-v2
+  mount: secret
+  path: victorialogs/vmauth/query
+  destination:
+    name: vmauth-logs-query-token
+    create: true
+  refreshAfter: 1h
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: vmauth-relay-ingest-token
+  namespace: victoriametrics
+spec:
+  type: kv-v2
+  mount: secret
+  path: victorialogs/vmauth/relay-ingest
+  destination:
+    name: vmauth-relay-ingest-token
+    create: true
+  refreshAfter: 1h
+  vaultAuthRef: default