apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: kube-state-metrics
  namespace: victoriametrics
spec:
  interval: 15m
  chart:
    spec:
      chart: kube-state-metrics
      version: 8.7.1
      sourceRef:
        kind: HelmRepository
        name: prometheus-community
        namespace: flux-system
  values:
    fullnameOverride: kube-state-metrics
    replicas: 2
    metricLabelsAllowlist:
      - services=[health.quorate.dev/name]
      - endpointslices=[kubernetes.io/service-name]
    resources:
      requests:
        cpu: 10m
        memory: 64Mi
      limits:
        memory: 256Mi
---
apiVersion: operator.victoriametrics.com/v1beta1
kind: VMServiceScrape
metadata:
  name: kube-state-metrics
  namespace: victoriametrics
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: kube-state-metrics
  namespaceSelector:
    matchNames: [victoriametrics]
  endpoints:
    - port: http
      honorLabels: true
  jobLabel: app.kubernetes.io/name
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: kube-state-metrics
  namespace: victoriametrics
spec:
  endpointSelector:
    matchLabels:
      app.kubernetes.io/name: kube-state-metrics
  ingress:
    - fromEntities: [host]
      toPorts:
        - ports:
            - port: "8080"
              protocol: TCP
            - port: "8081"
              protocol: TCP
    - fromEndpoints:
        - matchLabels:
            app.kubernetes.io/name: vmagent
            app.kubernetes.io/instance: main
      toPorts:
        - ports:
            - port: "8080"
              protocol: TCP
  egress:
    - toEntities: [kube-apiserver]
      toPorts:
        - ports:
            - port: "6443"
              protocol: TCP
---
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: host-kube-state
spec:
  nodeSelector: {}
  egress:
    - toEndpoints:
        - matchLabels:
            k8s:io.kubernetes.pod.namespace: victoriametrics
            app.kubernetes.io/name: kube-state-metrics
      toPorts:
        - ports:
            - port: "8080"
              protocol: TCP
            - port: "8081"
              protocol: TCP