service-catalog/manifests/helm/victoria-metrics-agent/0.40.0/custom-values.yaml

# =============================================================================
# vmagent — PaaSup 커스텀 오버라이드 (Kubernetes 메트릭 수집)
# 차트: victoria-metrics/victoria-metrics-agent
# 역할: kubelet / cadvisor / kube-state-metrics / node-exporter / 파드 annotation scrape
# 전송 대상: VictoriaMetrics Cluster vminsert:8480 (쓰기 경로는 vmauth 미경유)
#
# accountID 매핑(예시): 0=플랫폼 공통(fallback) / 1=demo01 / 2=demo02 / 9000=platform
#   네임스페이스별 분기는 urlRelabelConfig(ConfigMap: vmagent-relabel-configs) 마운트로 처리.
#   해당 ConfigMap은 온보딩 시 별도 생성한다(CUSTOM-README 참조).
#
# 테넌트 라우팅 = per-URL 의도적 채택(보안·격리). 차트는 인라인 urlRelabelConfig도 지원하나,
#   테넌시를 URL로 강제(스푸핑 차단)하고 테넌트 추가를 Git/PR로 통제하기 위해 per-tenant URL을 쓴다.
#   → 새 테넌트 = remoteWrite 항목 추가(이 파일 수정) + relabel 파일 추가. 상세: CUSTOM-README / 아키텍처 문서.
# =============================================================================

# remoteWrite — 최소 1개 필요. accountID별 엔드포인트 + urlRelabelConfig 파일 분기
remoteWrite:
  - url: "http://vmcluster-victoria-metrics-cluster-vminsert.monitoring.svc.cluster.local:8480/insert/1/prometheus/api/v1/write"
    urlRelabelConfig: /relabel/demo01.yaml
  - url: "http://vmcluster-victoria-metrics-cluster-vminsert.monitoring.svc.cluster.local:8480/insert/2/prometheus/api/v1/write"
    urlRelabelConfig: /relabel/demo02.yaml
  - url: "http://vmcluster-victoria-metrics-cluster-vminsert.monitoring.svc.cluster.local:8480/insert/9000/prometheus/api/v1/write"
    urlRelabelConfig: /relabel/platform.yaml
  - url: "http://vmcluster-victoria-metrics-cluster-vminsert.monitoring.svc.cluster.local:8480/insert/0/prometheus/api/v1/write"

extraVolumes:
  - name: relabel-configs
    configMap:
      name: vmagent-relabel-configs
extraVolumeMounts:
  - name: relabel-configs
    mountPath: /relabel

resources:
  requests:
    cpu: 50m
    memory: 128Mi
  limits:
    cpu: 500m
    memory: 512Mi

# 스크레이프 설정 — kubelet/cadvisor/exporters/파드 annotation
config:
  global:
    scrape_interval: 30s
    external_labels:
      cluster: local

  scrape_configs:
    - job_name: kubelet
      scheme: https
      tls_config:
        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        insecure_skip_verify: true
      authorization:
        credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token
      kubernetes_sd_configs:
        - role: node
      relabel_configs:
        - target_label: __address__
          replacement: kubernetes.default.svc:443
        - source_labels: [__meta_kubernetes_node_name]
          regex: (.+)
          target_label: __metrics_path__
          replacement: /api/v1/nodes/$1/proxy/metrics
        - source_labels: [__meta_kubernetes_node_name]
          target_label: node

    - job_name: cadvisor
      scheme: https
      tls_config:
        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        insecure_skip_verify: true
      authorization:
        credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token
      kubernetes_sd_configs:
        - role: node
      relabel_configs:
        - target_label: __address__
          replacement: kubernetes.default.svc:443
        - source_labels: [__meta_kubernetes_node_name]
          regex: (.+)
          target_label: __metrics_path__
          replacement: /api/v1/nodes/$1/proxy/metrics/cadvisor
        - source_labels: [__meta_kubernetes_node_name]
          target_label: node

    - job_name: kube-state-metrics
      honor_labels: true
      kubernetes_sd_configs:
        - role: endpoints
          namespaces:
            names: [monitoring]
      relabel_configs:
        - source_labels: [__meta_kubernetes_service_label_app_kubernetes_io_name]
          regex: kube-state-metrics
          action: keep
        - source_labels: [__meta_kubernetes_endpoint_port_name]
          regex: http
          action: keep

    - job_name: node-exporter
      kubernetes_sd_configs:
        - role: endpoints
          namespaces:
            names: [monitoring]
      relabel_configs:
        - source_labels: [__meta_kubernetes_service_label_app_kubernetes_io_name]
          regex: prometheus-node-exporter
          action: keep
        - source_labels: [__meta_kubernetes_endpoint_port_name]
          regex: metrics
          action: keep
        - source_labels: [__meta_kubernetes_pod_node_name]
          target_label: node

    - job_name: kubernetes-pods
      kubernetes_sd_configs:
        - role: pod
      relabel_configs:
        - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
          regex: "true"
          action: keep
        - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path]
          regex: (.+)
          target_label: __metrics_path__
        - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
          regex: ([^:]+)(?::\d+)?;(\d+)
          replacement: $1:$2
          target_label: __address__
        - source_labels: [__meta_kubernetes_namespace]
          target_label: namespace
        - source_labels: [__meta_kubernetes_pod_name]
          target_label: pod
        - source_labels: [__meta_kubernetes_pod_label_app]
          target_label: app

# RBAC — kubelet/cadvisor/엔드포인트 접근 권한
rbac:
  create: true
  extraRules:
    - apiGroups: [""]
      resources: [nodes, nodes/proxy, nodes/metrics, pods, services, endpoints, namespaces]
      verbs: [get, list, watch]
    - nonResourceURLs: [/metrics, /metrics/cadvisor]
      verbs: [get]