Merge branch 'development' into 'master'

chore: release to stable

See merge request nofusscomputing/projects/kubernetes_monitoring!6

.cz.yaml

@@ -4,4 +4,4 @@ commitizen:
   name: cz_conventional_commits
   tag_format: $major.$minor.$patch$prerelease
   update_changelog_on_bump: true
-  version: 0.1.0
+  version: 0.2.0rc0

CHANGELOG.md

@@ -1,3 +1,24 @@
+## 0.2.0rc0 (2023-11-06)
+
+### Code Refactor
+
+- **grafana_datasources**: [cf38a415](https://gitlab.com/nofusscomputing/projects/kubernetes_monitoring/-/commit/cf38a4156adcbdda150fe309f1f7dd97a5a3bf07) - default prom set to thanos [ [!4](https://gitlab.com/nofusscomputing/projects/kubernetes_monitoring/-/merge_requests/4) ]
+
+### Features
+
+- **Grafana**: [b047f33e](https://gitlab.com/nofusscomputing/projects/kubernetes_monitoring/-/commit/b047f33e275d2e908f7e8a220944573f2e367bf7) - Configure grafana from values.yaml [ [!4](https://gitlab.com/nofusscomputing/projects/kubernetes_monitoring/-/merge_requests/4) ]
+- **GrafanaAgent**: [0c296c17](https://gitlab.com/nofusscomputing/projects/kubernetes_monitoring/-/commit/0c296c173e786c77504fabba337b464bcde6c290) - Network Policy added [ [!4](https://gitlab.com/nofusscomputing/projects/kubernetes_monitoring/-/merge_requests/4) ]
+- **grafana**: [7164bb2e](https://gitlab.com/nofusscomputing/projects/kubernetes_monitoring/-/commit/7164bb2e0b5f2c5e7fb59bcb64321eabb651b08e) - Network Policy added [ [!4](https://gitlab.com/nofusscomputing/projects/kubernetes_monitoring/-/merge_requests/4) ]
+- **prometheus**: [ae35e704](https://gitlab.com/nofusscomputing/projects/kubernetes_monitoring/-/commit/ae35e704e33bee4d2fea3390a7965a087e30acce) - Network Policy added [ [!4](https://gitlab.com/nofusscomputing/projects/kubernetes_monitoring/-/merge_requests/4) ]
+- **NetworkPolicy**: [5c62055d](https://gitlab.com/nofusscomputing/projects/kubernetes_monitoring/-/commit/5c62055d2f2041b33a2ab5ff8023cf8bd6b08df1) - configure from values.yaml [ [!4](https://gitlab.com/nofusscomputing/projects/kubernetes_monitoring/-/merge_requests/4) ]
+- **labels**: [03affbee](https://gitlab.com/nofusscomputing/projects/kubernetes_monitoring/-/commit/03affbee809d9e36f0930ae49ab07191e2b645a2) - lables moved to values.yaml [ [!4](https://gitlab.com/nofusscomputing/projects/kubernetes_monitoring/-/merge_requests/4) ]
+- **graph**: [65b61ecf](https://gitlab.com/nofusscomputing/projects/kubernetes_monitoring/-/commit/65b61ecf545800bcbf4efc7e3175951b9c6d2965) - add ceph size/used to dashboard [ [!4](https://gitlab.com/nofusscomputing/projects/kubernetes_monitoring/-/merge_requests/4) ]
+- **prometheus**: [7afc6aa5](https://gitlab.com/nofusscomputing/projects/kubernetes_monitoring/-/commit/7afc6aa515db4a43ce8dc1a152f45f400fc68a39) - rule selector configurable from values.yaml [ [!4](https://gitlab.com/nofusscomputing/projects/kubernetes_monitoring/-/merge_requests/4) ]
+- **promtail**: [2371adcb](https://gitlab.com/nofusscomputing/projects/kubernetes_monitoring/-/commit/2371adcbc5d64a27ff72b0ac45f589ccef4eb400) - split node to seperate promtail service monitor [ [!4](https://gitlab.com/nofusscomputing/projects/kubernetes_monitoring/-/merge_requests/4) ]
+- **grafana_agent**: [f73a9e46](https://gitlab.com/nofusscomputing/projects/kubernetes_monitoring/-/commit/f73a9e462e16dffbc0e17eaed3c0c78aff95d52b) - add prom rules [ [!4](https://gitlab.com/nofusscomputing/projects/kubernetes_monitoring/-/merge_requests/4) ]
+- **prometheus**: [5bb71971](https://gitlab.com/nofusscomputing/projects/kubernetes_monitoring/-/commit/5bb71971292b8f760e9b348652dc9df3c0dfa921) - tsdb retention set [ [!4](https://gitlab.com/nofusscomputing/projects/kubernetes_monitoring/-/merge_requests/4) ]
+- **thanos**: [be016187](https://gitlab.com/nofusscomputing/projects/kubernetes_monitoring/-/commit/be0161876d6b6868204af06255a01f08cc62c6ea) - prometheus rules added for sidecar [ [!4](https://gitlab.com/nofusscomputing/projects/kubernetes_monitoring/-/merge_requests/4) ]
+
 ## 0.1.0 (2023-09-27)
 
 ### Bug Fixes

docs/projects/kubernetes_monitoring/index.md

@@ -113,6 +113,8 @@ This helm chart started off with components from multiple open-source projects.
 
     - Prometheus-Adaptor
 
+    - Promtail
+
     - Thanos
 
 - kyverno policies _(optional, set in values.yaml)_

files/dashboard-summary.json

@@ -18,7 +18,7 @@
   "editable": true,
   "fiscalYearStartMonth": 0,
   "graphTooltip": 0,
-  "id": 66,
+  "id": 68,
   "links": [],
   "liveNow": false,
   "panels": [
@@ -630,13 +630,107 @@
       "transparent": true,
       "type": "stat"
     },
+    {
+      "datasource": {
+        "type": "prometheus",
+        "uid": "${PROMETHEUS}"
+      },
+      "description": "How much is used and Size",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "thresholds"
+          },
+          "mappings": [
+            {
+              "options": {
+                "Size": {
+                  "color": "green",
+                  "index": 0
+                }
+              },
+              "type": "value"
+            }
+          ],
+          "min": 0,
+          "thresholds": {
+            "mode": "percentage",
+            "steps": [
+              {
+                "color": "#007d35",
+                "value": null
+              }
+            ]
+          },
+          "unit": "bytes"
+        },
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 4,
+        "w": 5,
+        "x": 3,
+        "y": 8
+      },
+      "id": 19,
+      "options": {
+        "colorMode": "background",
+        "graphMode": "area",
+        "justifyMode": "center",
+        "orientation": "vertical",
+        "reduceOptions": {
+          "calcs": [
+            "last"
+          ],
+          "fields": "",
+          "values": false
+        },
+        "textMode": "auto"
+      },
+      "pluginVersion": "10.1.2",
+      "targets": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${PROMETHEUS}"
+          },
+          "editorMode": "code",
+          "exemplar": false,
+          "expr": "sum(ceph_osd_stat_bytes_used)",
+          "format": "time_series",
+          "hide": false,
+          "instant": true,
+          "legendFormat": "Used",
+          "range": false,
+          "refId": "A"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${PROMETHEUS}"
+          },
+          "editorMode": "code",
+          "exemplar": false,
+          "expr": "sum(ceph_osd_stat_bytes)",
+          "format": "time_series",
+          "hide": false,
+          "instant": true,
+          "legendFormat": "Size",
+          "range": false,
+          "refId": "B"
+        }
+      ],
+      "title": "Storage",
+      "transformations": [],
+      "type": "stat"
+    },
     {
       "collapsed": false,
       "gridPos": {
         "h": 1,
         "w": 24,
         "x": 0,
-        "y": 11
+        "y": 12
       },
       "id": 2,
       "panels": [],
@@ -672,7 +766,7 @@
         "h": 3,
         "w": 4,
         "x": 0,
-        "y": 12
+        "y": 13
       },
       "id": 12,
       "options": {
@@ -743,7 +837,7 @@
         "h": 3,
         "w": 4,
         "x": 4,
-        "y": 12
+        "y": 13
       },
       "id": 17,
       "options": {
@@ -814,7 +908,7 @@
         "h": 3,
         "w": 4,
         "x": 8,
-        "y": 12
+        "y": 13
       },
       "id": 16,
       "options": {
@@ -884,7 +978,7 @@
         "h": 3,
         "w": 4,
         "x": 12,
-        "y": 12
+        "y": 13
       },
       "id": 13,
       "options": {
@@ -955,7 +1049,7 @@
         "h": 3,
         "w": 4,
         "x": 16,
-        "y": 12
+        "y": 13
       },
       "id": 18,
       "options": {
@@ -1027,7 +1121,7 @@
         "h": 3,
         "w": 4,
         "x": 20,
-        "y": 12
+        "y": 13
       },
       "id": 15,
       "options": {
@@ -1131,7 +1225,7 @@
         "h": 9,
         "w": 12,
         "x": 0,
-        "y": 15
+        "y": 16
       },
       "id": 1,
       "options": {
@@ -1225,7 +1319,7 @@
         "h": 9,
         "w": 12,
         "x": 12,
-        "y": 15
+        "y": 16
       },
       "id": 14,
       "options": {
@@ -1257,7 +1351,7 @@
       "type": "timeseries"
     }
   ],
-  "refresh": "5s",
+  "refresh": "10s",
   "schemaVersion": 38,
   "style": "dark",
   "tags": [
@@ -1269,9 +1363,9 @@
     "list": [
       {
         "current": {
-          "selected": true,
+          "selected": false,
-          "text": "prometheus",
+          "text": "thanos",
-          "value": "77e897ec-8a32-4b71-9439-8f12ec42e920"
+          "value": "603ac67d-7d32-4fba-8ec3-35106f3c4cc9"
         },
         "hide": 0,
         "includeAll": false,
@@ -1296,6 +1390,6 @@
   "timezone": "",
   "title": "Cluster Overview",
   "uid": "no-fuss-computing-k8s-overview",
-  "version": 4,
+  "version": 5,
   "weekStart": ""
 }

templates/APIService-prometheus-adapter.yaml

@@ -3,9 +3,7 @@ apiVersion: apiregistration.k8s.io/v1
 kind: APIService
 metadata:
   labels:
-    app.kubernetes.io/component: metrics-adapter
+    {{ toYaml $.Values.nfc_monitoring.prometheus_adaptor.labels | nindent 4 }}
-    app.kubernetes.io/instance: main
-    app.kubernetes.io/name: prometheus-adapter
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/version: {{ $.Chart.Version }}

templates/AlertManager-k8s.yaml

@@ -3,9 +3,7 @@ apiVersion: monitoring.coreos.com/v1
 kind: Alertmanager
 metadata:
   labels:
-    app.kubernetes.io/instance: main
+    {{ toYaml $.Values.nfc_monitoring.alert_manager.labels | nindent 4 }}
-    app.kubernetes.io/component: alert-router
-    app.kubernetes.io/name: alertmanager
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/version: {{ $.Chart.Version }}

templates/ClusterPolicy-Prometheus-Role.yaml

@@ -14,8 +14,7 @@ metadata:
       monitoring instances is created to enable monitoring of  the namespace in
       question.
   labels:
-    app.kubernetes.io/component: prometheus
+    {{ toYaml $.Values.nfc_monitoring.prometheus.labels | nindent 4 }}
-    app.kubernetes.io/name: prometheus
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/version: {{ $.Chart.Version }}
@@ -38,9 +37,7 @@ spec:
         data:
           metadata:
             labels:
-              app.kubernetes.io/component: prometheus
+              {{ toYaml $.Values.nfc_monitoring.prometheus.labels | nindent 14 }}
-              app.kubernetes.io/instance: k8s
-              app.kubernetes.io/name: prometheus
               app.kubernetes.io/part-of: {{ $.Chart.Name }}
               app.kubernetes.io/version: {{ $.Chart.Version }}
             

templates/ClusterPolicy-Prometheus-RoleBinding.yaml

@@ -14,8 +14,7 @@ metadata:
       monitoring instances is created to enable monitoring of  the namespace in
       question.
   labels:
-    app.kubernetes.io/component: prometheus
+    {{ toYaml $.Values.nfc_monitoring.prometheus.labels | nindent 4 }}
-    app.kubernetes.io/name: prometheus
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/version: {{ $.Chart.Version }}
@@ -38,8 +37,7 @@ spec:
         data:
           metadata:
             labels:
-              app.kubernetes.io/component: prometheus
+              {{ toYaml $.Values.nfc_monitoring.prometheus.labels | nindent 14 }}
-              app.kubernetes.io/name: prometheus
               app.kubernetes.io/part-of: {{ $.Chart.Name }}
               app.kubernetes.io/version: {{ $.Chart.Version }}
           roleRef:

templates/ClusterRole-GrafanaAgent.yaml

@@ -4,9 +4,7 @@ kind: ClusterRole
 metadata:
   name: grafana-agent
   labels:
-    app.kubernetes.io/instance: k8s
+    {{ toYaml $.Values.nfc_monitoring.grafana_agent.labels | nindent 4 }}
-    app.kubernetes.io/component: exporter
-    app.kubernetes.io/name: grafana-agent
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/version: {{ $.Chart.Version }}

templates/ClusterRole-aggregated-metrics-reader.yaml

@@ -3,9 +3,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
-    app.kubernetes.io/component: metrics-adapter
+    {{ toYaml $.Values.nfc_monitoring.prometheus_adaptor.labels | nindent 4 }}
-    app.kubernetes.io/instance: main
-    app.kubernetes.io/name: prometheus-adapter
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/version: {{ $.Chart.Version }}

templates/ClusterRole-binding-delegator-prometheus-adaptor.yaml

@@ -3,8 +3,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   labels:
-    app.kubernetes.io/component: metrics-adapter
+    {{ toYaml $.Values.nfc_monitoring.prometheus_adaptor.labels | nindent 4 }}
-    app.kubernetes.io/name: prometheus-adapter
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/version: {{ $.Chart.Version }}

templates/ClusterRole-binding-hpa-custom-metrics-prometheus-adaptor.yaml

@@ -4,8 +4,7 @@ kind: ClusterRoleBinding
 metadata:
   name: hpa-controller-custom-metrics
   labels:
-    app.kubernetes.io/component: metrics-adapter
+    {{ toYaml $.Values.nfc_monitoring.prometheus_adaptor.labels | nindent 4 }}
-    app.kubernetes.io/name: prometheus-adapter
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/version: {{ $.Chart.Version }}

templates/ClusterRole-binding-prometheus.yaml

@@ -3,8 +3,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   labels:
-    app.kubernetes.io/component: metrics-adapter
+    {{ toYaml $.Values.nfc_monitoring.prometheus.labels | nindent 4 }}
-    app.kubernetes.io/name: prometheus-adapter
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/version: {{ $.Chart.Version }}

templates/ClusterRole-grafana-SideCar.yaml

@@ -4,9 +4,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
-    app.kubernetes.io/component: graphing
+    {{ toYaml $.Values.nfc_monitoring.grafana.labels | nindent 4 }}
-    app.kubernetes.io/instance: k8s
-    app.kubernetes.io/name: grafana
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/version: {{ $.Chart.Version }}

templates/ClusterRole-metrics-server-resources-prometheus-adaptor.yaml

@@ -3,8 +3,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
-    app.kubernetes.io/component: metrics-adapter
+    {{ toYaml $.Values.nfc_monitoring.prometheus_adaptor.labels | nindent 4 }}
-    app.kubernetes.io/name: prometheus-adapter
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/version: {{ $.Chart.Version }}

templates/ClusterRole-prometheus-adapter.yaml

@@ -3,9 +3,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
-    app.kubernetes.io/component: metrics-adapter
+    {{ toYaml $.Values.nfc_monitoring.prometheus_adaptor.labels | nindent 4 }}
-    app.kubernetes.io/instance: main
-    app.kubernetes.io/name: prometheus-adapter
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/version: {{ $.Chart.Version }}

templates/ClusterRole-prometheus.yaml

@@ -3,9 +3,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
-    app.kubernetes.io/component: prometheus
+    {{ toYaml $.Values.nfc_monitoring.prometheus.labels | nindent 4 }}
-    app.kubernetes.io/instance: k8s
-    app.kubernetes.io/name: prometheus
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/version: {{ $.Chart.Version }}

templates/ClusterRoleBinding-Grafana-Agent.yaml

@@ -3,9 +3,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   labels:
-    app.kubernetes.io/instance: k8s
+    {{ toYaml $.Values.nfc_monitoring.grafana_agent.labels | nindent 4 }}
-    app.kubernetes.io/component: exporter
-    app.kubernetes.io/name: grafana-agent
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/version: {{ $.Chart.Version }}

templates/ClusterRoleBinding-Grafana-SideCar.yaml

@@ -4,9 +4,7 @@ kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   labels:
-    app.kubernetes.io/component: graphing
+    {{ toYaml $.Values.nfc_monitoring.grafana.labels | nindent 4 }}
-    app.kubernetes.io/instance: k8s
-    app.kubernetes.io/name: grafana
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/version: {{ $.Chart.Version }}

templates/ClusterRoleBinding-prometheus.yaml

@@ -3,9 +3,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   labels:
-    app.kubernetes.io/component: prometheus
+    {{ toYaml $.Values.nfc_monitoring.prometheus.labels | nindent 4 }}
-    app.kubernetes.io/instance: k8s
-    app.kubernetes.io/name: prometheus
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/version: {{ $.Chart.Version }}

templates/ConfigMap-Grafana.yaml

@@ -5,9 +5,7 @@ metadata:
   name: grafana-config
   namespace: "{{ .Values.nfc_monitoring.grafana.namespace }}"
   labels:
-    app.kubernetes.io/component: graphing
+    {{ toYaml $.Values.nfc_monitoring.grafana.labels | nindent 4 }}
-    app.kubernetes.io/instance: k8s
-    app.kubernetes.io/name: grafana
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/version: {{ $.Chart.Version }}
@@ -50,9 +48,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   labels:
-    app.kubernetes.io/component: graphing
+    {{ toYaml $.Values.nfc_monitoring.grafana.labels | nindent 4 }}
-    app.kubernetes.io/instance: k8s
-    app.kubernetes.io/name: grafana
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/version: {{ $.Chart.Version }}

templates/ConfigMap-GrafanaAgent.yaml

@@ -3,9 +3,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   labels:
-    app.kubernetes.io/instance: k8s
+    {{ toYaml $.Values.nfc_monitoring.grafana_agent.labels | nindent 4 }}
-    app.kubernetes.io/component: exporter
-    app.kubernetes.io/name: grafana-agent
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/version: {{ $.Chart.Version }}
@@ -16,6 +14,8 @@ data:
     metrics:
       wal_directory: /tmp/wal
 
+
+
     logs:
       positions_directory: "/tmp"
 
@@ -254,7 +254,6 @@ data:
         netclass_ignored_devices: "^(veth.*|cali.*|[a-f0-9]{15})$"
         netdev_device_exclude: "^(veth.*|cali.*|[a-f0-9]{15})$"
 
-        scrape_integration: true
 
         include_exporter_metrics: true
         enable_collectors:

templates/ConfigMap-GrafanaProvisioning.yaml

@@ -5,9 +5,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   labels:
-    app.kubernetes.io/component: graphing
+    {{ toYaml $.Values.nfc_monitoring.grafana.labels | nindent 4 }}
-    app.kubernetes.io/instance: k8s
-    app.kubernetes.io/name: grafana
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/version: {{ $.Chart.Version }}

templates/ConfigMap-prometheus-adapter.yaml

@@ -3,9 +3,7 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   labels:
-    app.kubernetes.io/component: metrics-adapter
+    {{ toYaml $.Values.nfc_monitoring.prometheus_adaptor.labels | nindent 4 }}
-    app.kubernetes.io/instance: main
-    app.kubernetes.io/name: prometheus-adapter
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/version: {{ $.Chart.Version }}

templates/Daemonset-GrafanaAgent.yaml

@@ -3,9 +3,7 @@ apiVersion: apps/v1
 kind: DaemonSet
 metadata:
   labels:
-    app.kubernetes.io/instance: k8s
+    {{ toYaml $.Values.nfc_monitoring.grafana_agent.labels | nindent 4 }}
-    app.kubernetes.io/component: exporter
-    app.kubernetes.io/name: grafana-agent
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/version: {{ $.Chart.Version }}
@@ -17,9 +15,7 @@ metadata:
 spec:
   selector:
     matchLabels:
-      app.kubernetes.io/instance: k8s
+      {{ toYaml $.Values.nfc_monitoring.grafana_agent.labels | nindent 6 }}
-      app.kubernetes.io/component: exporter
-      app.kubernetes.io/name: grafana-agent
       app.kubernetes.io/managed-by: {{ $.Release.Service }}
       app.kubernetes.io/part-of: {{ $.Chart.Name }}
       app.kubernetes.io/version: {{ $.Chart.Version }}
@@ -29,9 +25,7 @@ spec:
   template:
     metadata:
       labels:
-        app.kubernetes.io/instance: k8s
+        {{ toYaml $.Values.nfc_monitoring.grafana_agent.labels | nindent 8 }}
-        app.kubernetes.io/component: exporter
-        app.kubernetes.io/name: grafana-agent
         app.kubernetes.io/managed-by: {{ $.Release.Service }}
         app.kubernetes.io/part-of: {{ $.Chart.Name }}
         app.kubernetes.io/version: {{ $.Chart.Version }}

templates/Deployment-prometheus-adapter.yaml

@@ -3,9 +3,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   labels:
-    app.kubernetes.io/component: metrics-adapter
+    {{ toYaml $.Values.nfc_monitoring.prometheus_adaptor.labels | nindent 4 }}
-    app.kubernetes.io/instance: main
-    app.kubernetes.io/name: prometheus-adapter
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/version: {{ $.Chart.Version }}
@@ -15,9 +13,7 @@ spec:
   replicas: 2
   selector:
     matchLabels:
-      app.kubernetes.io/component: metrics-adapter
+      {{ toYaml $.Values.nfc_monitoring.prometheus_adaptor.labels | nindent 6 }}
-      app.kubernetes.io/instance: main
-      app.kubernetes.io/name: prometheus-adapter
       app.kubernetes.io/part-of: {{ $.Chart.Name }}
       app.kubernetes.io/managed-by: {{ $.Release.Service }}
       app.kubernetes.io/version: {{ $.Chart.Version }}
@@ -28,9 +24,7 @@ spec:
   template:
     metadata:
       labels:
-        app.kubernetes.io/component: metrics-adapter
+        {{ toYaml $.Values.nfc_monitoring.prometheus_adaptor.labels | nindent 8 }}
-        app.kubernetes.io/instance: main
-        app.kubernetes.io/name: prometheus-adapter
         app.kubernetes.io/part-of: {{ $.Chart.Name }}
         app.kubernetes.io/managed-by: {{ $.Release.Service }}
         app.kubernetes.io/version: {{ $.Chart.Version }}

templates/Grafana-Grafana.yaml

@@ -3,9 +3,7 @@ apiVersion: grafana.integreatly.org/v1beta1
 kind: Grafana
 metadata:
   labels:
-    app.kubernetes.io/component: graphing
+    {{ toYaml $.Values.nfc_monitoring.grafana.labels | nindent 4 }}
-    app.kubernetes.io/instance: k8s
-    app.kubernetes.io/name: grafana
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/version: {{ $.Chart.Version }}
@@ -13,19 +11,11 @@ metadata:
   namespace: "{{ .Values.nfc_monitoring.grafana.namespace }}"
 spec:
   config:
-    log:
+    {{ toYaml $.Values.nfc_monitoring.grafana.config | nindent 4 }}
-      mode: "console"
-    auth:
-      disable_login_form: "false"
-    security:
-      admin_user: "{{ .Values.nfc_monitoring.grafana.admin_user }}"
-      admin_password: "{{ .Values.nfc_monitoring.grafana.admin_password }}"
   deployment:
     metadata:
       labels:
-        app.kubernetes.io/component: graphing
+        {{ toYaml $.Values.nfc_monitoring.grafana.labels | nindent 8 }}
-        app.kubernetes.io/instance: k8s
-        app.kubernetes.io/name: grafana
         app.kubernetes.io/managed-by: {{ $.Release.Service }}
         app.kubernetes.io/part-of: {{ $.Chart.Name }}
         app.kubernetes.io/version: {{ $.Chart.Version }}
@@ -33,9 +23,7 @@ spec:
       replicas: {{ .Values.nfc_monitoring.grafana.replicas | int }}
       selector:
         matchLabels:
-          app.kubernetes.io/component: graphing
+          {{ toYaml $.Values.nfc_monitoring.grafana.labels | nindent 10 }}
-          app.kubernetes.io/instance: k8s
-          app.kubernetes.io/name: grafana
           app.kubernetes.io/managed-by: {{ $.Release.Service }}
           app.kubernetes.io/part-of: {{ $.Chart.Name }}
       strategy:
@@ -45,9 +33,7 @@ spec:
       template:
         metadata:
           labels:
-            app.kubernetes.io/component: graphing
+            {{ toYaml $.Values.nfc_monitoring.grafana.labels | nindent 12 }}
-            app.kubernetes.io/instance: k8s
-            app.kubernetes.io/name: grafana
             app.kubernetes.io/managed-by: {{ $.Release.Service }}
             app.kubernetes.io/part-of: {{ $.Chart.Name }}
             app.kubernetes.io/version: {{ $.Chart.Version }}
@@ -157,7 +143,7 @@ spec:
         app.kubernetes.io/part-of: {{ $.Chart.Name }}
     spec:
       accessModes:
-        - "ReadWriteMany"
+        - {{ .Values.nfc_monitoring.grafana.storage_accessModes | default "ReadWriteOnce" }}
       resources:
         requests:
           storage: "5Gi"

templates/GrafanaDatasources.yaml

@@ -18,9 +18,7 @@ items:
     spec:
       instanceSelector:
         matchLabels:
-          app.kubernetes.io/component: graphing
+          {{ toYaml $.Values.nfc_monitoring.grafana.labels | nindent 10 }}
-          app.kubernetes.io/instance: k8s
-          app.kubernetes.io/name: grafana
       allowCrossNamespaceImport: true
       datasource:
         {{ toYaml . | nindent 8 }}

templates/Ingress-Multi.yaml

@@ -0,0 +1,41 @@
+{{ if .Values.nfc_monitoring.alert_manager.ingress.enabled | default "false" -}}
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: alertmanager
+  namespace: "{{ .Values.nfc_monitoring.alert_manager.namespace }}"
+  annotations:
+    {{ toYaml $.Values.nfc_monitoring.alert_manager.ingress.annotations | nindent 4 }}
+spec:
+  {{ toYaml $.Values.nfc_monitoring.alert_manager.ingress.spec | nindent 2 }}
+
+{{ end }}
+
+{{ if .Values.nfc_monitoring.grafana.ingress.enabled | default "false" -}}
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: grafana
+  namespace: "{{ .Values.nfc_monitoring.grafana.namespace }}"
+  annotations:
+    {{ toYaml $.Values.nfc_monitoring.grafana.ingress.annotations | nindent 4 }}
+spec:
+  {{ toYaml $.Values.nfc_monitoring.grafana.ingress.spec | nindent 2 }}
+
+{{ end }}
+
+{{ if .Values.nfc_monitoring.prometheus.ingress.enabled | default "false" -}}
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: prometheus
+  namespace: "{{ .Values.nfc_monitoring.prometheus.namespace }}"
+  annotations:
+    {{ toYaml $.Values.nfc_monitoring.prometheus.ingress.annotations | nindent 4 }}
+spec:
+  {{ toYaml $.Values.nfc_monitoring.prometheus.ingress.spec | nindent 2 }}
+
+{{ end }}

templates/NetworkPolicy.yaml

@@ -0,0 +1,21 @@
+
+{{ range .Values.nfc_monitoring.network_policy.policies }}
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  labels:
+    {{ toYaml (get $.Values.nfc_monitoring .name ).labels | nindent 4 }}
+    app.kubernetes.io/managed-by: {{ $.Release.Service }}
+    app.kubernetes.io/part-of: {{ $.Chart.Name }}
+    app.kubernetes.io/version: {{ $.Chart.Version }}
+  name: {{ .name  | replace "_" "-" }}
+  namespace: {{ (get $.Values.nfc_monitoring .name ).namespace }}
+spec:
+  {{ toYaml .policy | nindent 2 }}
+
+  podSelector:
+    matchLabels:
+      {{ toYaml (get $.Values.nfc_monitoring .name ).labels | nindent 6 }}
+
+{{ end }}

templates/PodDisruptionBudget-alertmanager.yaml

@@ -3,9 +3,7 @@ apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   labels:
-    app.kubernetes.io/component: alert-router
+    {{ toYaml $.Values.nfc_monitoring.alert_manager.labels | nindent 4 }}
-    app.kubernetes.io/instance: main
-    app.kubernetes.io/name: alertmanager
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/version: {{ $.Chart.Version }}
@@ -15,7 +13,5 @@ spec:
   maxUnavailable: 1
   selector:
     matchLabels:
-      app.kubernetes.io/component: alert-router
+      {{ toYaml $.Values.nfc_monitoring.alert_manager.labels | nindent 6 }}
-      app.kubernetes.io/instance: main
-      app.kubernetes.io/name: alertmanager
       app.kubernetes.io/part-of: {{ $.Chart.Name }}

templates/PodDisruptionBudget-prometheus-adapter.yaml

@@ -3,9 +3,7 @@ apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   labels:
-    app.kubernetes.io/component: metrics-adapter
+    {{ toYaml $.Values.nfc_monitoring.prometheus_adaptor.labels | nindent 4 }}
-    app.kubernetes.io/instance: main
-    app.kubernetes.io/name: prometheus-adapter
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/version: {{ $.Chart.Version }}
@@ -15,7 +13,5 @@ spec:
   minAvailable: 1
   selector:
     matchLabels:
-      app.kubernetes.io/component: metrics-adapter
+      {{ toYaml $.Values.nfc_monitoring.prometheus_adaptor.labels | nindent 6 }}
-      app.kubernetes.io/instance: main
-      app.kubernetes.io/name: prometheus-adapter
       app.kubernetes.io/part-of: {{ $.Chart.Name }}

templates/PodDisruptionBudget-prometheus.yaml

@@ -3,9 +3,7 @@ apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   labels:
-    app.kubernetes.io/component: prometheus
+    {{ toYaml $.Values.nfc_monitoring.prometheus.labels | nindent 4 }}
-    app.kubernetes.io/instance: k8s
-    app.kubernetes.io/name: prometheus
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/version: {{ $.Chart.Version }}
@@ -15,6 +13,5 @@ spec:
   minAvailable: 1
   selector:
     matchLabels:
-      app.kubernetes.io/component: prometheus
+      {{ toYaml $.Values.nfc_monitoring.prometheus.labels | nindent 6 }}
-      app.kubernetes.io/instance: k8s
       app.kubernetes.io/part-of: {{ $.Chart.Name }}

templates/Prometheus-prometheus.yaml

@@ -3,8 +3,7 @@ apiVersion: monitoring.coreos.com/v1
 kind: Prometheus
 metadata:
   labels:
-    app.kubernetes.io/component: prometheus
+    {{ toYaml $.Values.nfc_monitoring.prometheus.labels | nindent 4 }}
-    app.kubernetes.io/name: prometheus
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/version: {{ $.Chart.Version }}
@@ -26,9 +25,7 @@ spec:
     kubernetes.io/os: linux
   podMetadata:
     labels:
-      app.kubernetes.io/component: prometheus
+      {{ toYaml $.Values.nfc_monitoring.prometheus.labels | nindent 6 }}
-      app.kubernetes.io/instance: k8s
-      app.kubernetes.io/name: prometheus
       app.kubernetes.io/part-of: {{ $.Chart.Name }}
       app.kubernetes.io/managed-by: {{ $.Release.Service }}
       app.kubernetes.io/version: {{ $.Chart.Version }}
@@ -41,7 +38,6 @@ spec:
     requests:
       memory: 400Mi
   ruleNamespaceSelector: {}
-  ruleSelector: {}
   securityContext:
     fsGroup: 2000
     runAsNonRoot: true
@@ -50,7 +46,7 @@ spec:
   serviceMonitorNamespaceSelector: {}
   serviceMonitorSelector: {}
   storage:
-    {{- toYaml .Values.nfc_monitoring.prometheus.affinity | nindent 4 }}
+    {{- toYaml .Values.nfc_monitoring.prometheus.storage | nindent 4 }}
   {{ if .Values.nfc_monitoring.thanos.sidecar.enabled }}
   thanos:
     image: "{{ .Values.nfc_monitoring.thanos.image.name }}:{{ .Values.nfc_monitoring.thanos.image.tag }}"

templates/PrometheusRule-alertmanager.yaml

@@ -3,9 +3,7 @@ apiVersion: monitoring.coreos.com/v1
 kind: PrometheusRule
 metadata:
   labels:
-    app.kubernetes.io/component: alert-router
+    {{ toYaml $.Values.nfc_monitoring.alert_manager.labels | nindent 4 }}
-    app.kubernetes.io/instance: main
-    app.kubernetes.io/name: alertmanager
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/version: {{ $.Chart.Version }}

templates/PrometheusRule-grafana-agent.yaml

@@ -3,13 +3,12 @@ apiVersion: monitoring.coreos.com/v1
 kind: PrometheusRule
 metadata:
   labels:
-    app.kubernetes.io/component: exporter
+    {{ toYaml $.Values.nfc_monitoring.grafana_agent.labels | nindent 4 }}
-    app.kubernetes.io/name: grafana-agent
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/version: {{ $.Chart.Version }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     prometheus: k8s
-    role: grafana-agent-promtail
+    role: alert-rules
   name: grafana-agent
   namespace: {{ .Values.nfc_monitoring.prometheus.namespace }}
 spec:
@@ -21,3 +20,87 @@ spec:
     - expr: |
         agent_build_info
       record: promtail_build_info
+  - name: promtail_rules
+    rules:
+    - expr: histogram_quantile(0.99, sum(rate(promtail_request_duration_seconds_bucket[1m]))
+        by (le, job))
+      record: job:promtail_request_duration_seconds:99quantile
+    - expr: histogram_quantile(0.50, sum(rate(promtail_request_duration_seconds_bucket[1m]))
+        by (le, job))
+      record: job:promtail_request_duration_seconds:50quantile
+    - expr: sum(rate(promtail_request_duration_seconds_sum[1m])) by (job) / sum(rate(promtail_request_duration_seconds_count[1m]))
+        by (job)
+      record: job:promtail_request_duration_seconds:avg
+    - expr: sum(rate(promtail_request_duration_seconds_bucket[1m])) by (le, job)
+      record: job:promtail_request_duration_seconds_bucket:sum_rate
+    - expr: sum(rate(promtail_request_duration_seconds_sum[1m])) by (job)
+      record: job:promtail_request_duration_seconds_sum:sum_rate
+    - expr: sum(rate(promtail_request_duration_seconds_count[1m])) by (job)
+      record: job:promtail_request_duration_seconds_count:sum_rate
+    - expr: histogram_quantile(0.99, sum(rate(promtail_request_duration_seconds_bucket[1m]))
+        by (le, job, namespace))
+      record: job_namespace:promtail_request_duration_seconds:99quantile
+    - expr: histogram_quantile(0.50, sum(rate(promtail_request_duration_seconds_bucket[1m]))
+        by (le, job, namespace))
+      record: job_namespace:promtail_request_duration_seconds:50quantile
+    - expr: sum(rate(promtail_request_duration_seconds_sum[1m])) by (job, namespace)
+        / sum(rate(promtail_request_duration_seconds_count[1m])) by (job, namespace)
+      record: job_namespace:promtail_request_duration_seconds:avg
+    - expr: sum(rate(promtail_request_duration_seconds_bucket[1m])) by (le, job, namespace)
+      record: job_namespace:promtail_request_duration_seconds_bucket:sum_rate
+    - expr: sum(rate(promtail_request_duration_seconds_sum[1m])) by (job, namespace)
+      record: job_namespace:promtail_request_duration_seconds_sum:sum_rate
+    - expr: sum(rate(promtail_request_duration_seconds_count[1m])) by (job, namespace)
+      record: job_namespace:promtail_request_duration_seconds_count:sum_rate
+    - expr: histogram_quantile(0.99, sum(rate(promtail_request_duration_seconds_bucket[1m]))
+        by (le, job, status_code, namespace))
+      record: job_status_code_namespace:promtail_request_duration_seconds:99quantile
+    - expr: histogram_quantile(0.50, sum(rate(promtail_request_duration_seconds_bucket[1m]))
+        by (le, job, status_code, namespace))
+      record: job_status_code_namespace:promtail_request_duration_seconds:50quantile
+    - expr: sum(rate(promtail_request_duration_seconds_sum[1m])) by (job, status_code,
+        namespace) / sum(rate(promtail_request_duration_seconds_count[1m])) by (job,
+        status_code, namespace)
+      record: job_status_code_namespace:promtail_request_duration_seconds:avg
+    - expr: sum(rate(promtail_request_duration_seconds_bucket[1m])) by (le, job, status_code,
+        namespace)
+      record: job_status_code_namespace:promtail_request_duration_seconds_bucket:sum_rate
+    - expr: sum(rate(promtail_request_duration_seconds_sum[1m])) by (job, status_code,
+        namespace)
+      record: job_status_code_namespace:promtail_request_duration_seconds_sum:sum_rate
+    - expr: sum(rate(promtail_request_duration_seconds_count[1m])) by (job, status_code,
+        namespace)
+      record: job_status_code_namespace:promtail_request_duration_seconds_count:sum_rate
+
+  - name: promtail_alerts
+    rules:
+    - alert: PromtailRequestsErrors
+      annotations:
+        message: |
+          {{ `{{` }} $labels.job }} {{ `{{` }} $labels.route }} is experiencing {{ `{{` }} printf "%.2f" $value }}% errors.
+      expr: |
+        100 * sum(rate(promtail_request_duration_seconds_count{status_code=~"5..|failed"}[1m])) by (namespace, job, route, instance)
+          /
+        sum(rate(promtail_request_duration_seconds_count[1m])) by (namespace, job, route, instance)
+          > 10
+      for: 15m
+      labels:
+        severity: critical
+    - alert: PromtailRequestLatency
+      annotations:
+        message: |
+          {{ `{{` }} $labels.job }} {{ `{{` }} $labels.route }} is experiencing {{ `{{` }} printf "%.2f" $value }}s 99th percentile latency.
+      expr: |
+        job_status_code_namespace:promtail_request_duration_seconds:99quantile > 1
+      for: 15m
+      labels:
+        severity: critical
+    - alert: PromtailFileMissing
+      annotations:
+        message: |
+          {{ `{{` }} $labels.instance }} {{ `{{` }} $labels.job }} {{ `{{` }} $labels.path }} matches the glob but is not being tailed.
+      expr: |
+        promtail_file_bytes_total unless promtail_read_bytes_total
+      for: 15m
+      labels:
+        severity: warning

templates/PrometheusRule-grafana.yaml

@@ -3,8 +3,7 @@ apiVersion: monitoring.coreos.com/v1
 kind: PrometheusRule
 metadata:
   labels:
-    app.kubernetes.io/component: grafana
+    {{ toYaml $.Values.nfc_monitoring.grafana.labels | nindent 4 }}
-    app.kubernetes.io/name: grafana
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/version: {{ $.Chart.Version }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}

templates/PrometheusRule-prometheus.yaml

@@ -3,8 +3,7 @@ apiVersion: monitoring.coreos.com/v1
 kind: PrometheusRule
 metadata:
   labels:
-    app.kubernetes.io/component: prometheus
+    {{ toYaml $.Values.nfc_monitoring.prometheus.labels | nindent 4 }}
-    app.kubernetes.io/name: prometheus
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/version: {{ $.Chart.Version }}

templates/PrometheusRule-thanos.yaml

@@ -0,0 +1,55 @@
+{{ if .Values.nfc_monitoring.thanos.sidecar.enabled }}
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  labels:
+    app.kubernetes.io/component: metrics
+    app.kubernetes.io/name: thanos
+    app.kubernetes.io/part-of: {{  $.Chart.Name }}
+    app.kubernetes.io/managed-by: {{  $.Release.Service }}
+    app.kubernetes.io/version: {{  $.Chart.Version }}
+    prometheus: k8s
+    role: alert-rules
+  name: thanos-sidecar-rules
+  namespace: {{  .Values.nfc_monitoring.prometheus.namespace }}
+spec:
+  groups:
+    - name: thanos-sidecar
+      rules:
+      - alert: ThanosSidecarBucketOperationsFailed
+        annotations:
+          description: Thanos Sidecar {{ `{{` }}$labels.instance}} bucket operations are failing
+          runbook_url: https://github.com/thanos-io/thanos/tree/main/mixin/runbook.md#alert-name-thanossidecarbucketoperationsfailed
+          summary: Thanos Sidecar bucket operations are failing
+        expr: |
+          sum by (job, instance) (rate(thanos_objstore_bucket_operation_failures_total{job=~".*thanos-sidecar.*"}[5m])) > 0
+        for: 5m
+        labels:
+          severity: critical
+      - alert: ThanosSidecarNoConnectionToStartedPrometheus
+        annotations:
+          description: Thanos Sidecar {{ `{{` }}$labels.instance}} is unhealthy.
+          runbook_url: https://github.com/thanos-io/thanos/tree/main/mixin/runbook.md#alert-name-thanossidecarnoconnectiontostartedprometheus
+          summary: Thanos Sidecar cannot access Prometheus, even though Prometheus seems
+            healthy and has reloaded WAL.
+        expr: |
+          thanos_sidecar_prometheus_up{job=~".*thanos-sidecar.*"} == 0
+          AND on (namespace, pod)
+          prometheus_tsdb_data_replay_duration_seconds != 0
+        for: 5m
+        labels:
+          severity: critical
+      - alert: ThanosSidecarIsDown
+        annotations:
+          description: ThanosSidecar has disappeared. Prometheus target for the component
+            cannot be discovered.
+          runbook_url: https://github.com/thanos-io/thanos/tree/main/mixin/runbook.md#alert-name-thanossidecarisdown
+          summary: Thanos component has disappeared.
+        expr: |
+          absent(up{job=~".*thanos-sidecar.*"} == 1)
+        for: 5m
+        labels:
+          severity: critical
+
+{{ end }}

templates/Role-SpecificNamespaces-prometheus.yaml

@@ -7,9 +7,7 @@ items:
   kind: Role
   metadata:
     labels:
-      app.kubernetes.io/component: prometheus
+      {{ toYaml $.Values.nfc_monitoring.prometheus.labels | nindent 6 }}
-      app.kubernetes.io/instance: k8s
-      app.kubernetes.io/name: prometheus
       app.kubernetes.io/part-of: {{ $.Chart.Name }}
       app.kubernetes.io/managed-by: {{ $.Release.Service }}
       app.kubernetes.io/version: {{ $.Chart.Version }}

templates/RoleBinding-Config-prometheus.yaml

@@ -3,9 +3,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   labels:
-    app.kubernetes.io/component: prometheus
+    {{ toYaml $.Values.nfc_monitoring.prometheus.labels | nindent 4 }}
-    app.kubernetes.io/instance: k8s
-    app.kubernetes.io/name: prometheus
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/version: {{ $.Chart.Version }}

templates/RoleBinding-SpecificNamespaces-prometheus.yaml

@@ -6,9 +6,7 @@ items:
   kind: RoleBinding
   metadata:
     labels:
-      app.kubernetes.io/component: prometheus
+      {{ toYaml $.Values.nfc_monitoring.prometheus.labels | nindent 6 }}
-      app.kubernetes.io/instance: k8s
-      app.kubernetes.io/name: prometheus
       app.kubernetes.io/part-of: {{ $.Chart.Name }}
       app.kubernetes.io/managed-by: {{ $.Release.Service }}
       app.kubernetes.io/version: {{ $.Chart.Version }}

templates/RoleBinding-prometheus-adapter-auth-reader.yaml

@@ -3,8 +3,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   labels:
-    app.kubernetes.io/component: metrics-adapter
+    {{ toYaml $.Values.nfc_monitoring.prometheus_adaptor.labels | nindent 4 }}
-    app.kubernetes.io/name: prometheus-adapter
     app.kubernetes.io/version: 0.11.1
   name: resource-metrics-auth-reader
   namespace: kube-system

templates/RoleConfig-prometheus.yaml

@@ -3,9 +3,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   labels:
-    app.kubernetes.io/component: prometheus
+    {{ toYaml $.Values.nfc_monitoring.prometheus.labels | nindent 4 }}
-    app.kubernetes.io/instance: k8s
-    app.kubernetes.io/name: prometheus
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/version: {{ $.Chart.Version }}

templates/Secret-alertmanager.yaml

@@ -3,9 +3,7 @@ apiVersion: v1
 kind: Secret
 metadata:
   labels:
-    app.kubernetes.io/component: alert-router
+    {{ toYaml $.Values.nfc_monitoring.alert_manager.labels | nindent 4 }}
-    app.kubernetes.io/instance: main
-    app.kubernetes.io/name: alertmanager
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/version: {{ $.Chart.Version }}

templates/Secret-prometheus-sidecar-thanos.yaml

@@ -3,6 +3,11 @@
 apiVersion: v1
 kind: Secret
 metadata:
+  labels:
+    {{ toYaml $.Values.nfc_monitoring.prometheus.labels | nindent 4 }}
+    app.kubernetes.io/part-of: {{ $.Chart.Name }}
+    app.kubernetes.io/managed-by: {{ $.Release.Service }}
+    app.kubernetes.io/version: {{ $.Chart.Version }}
   name: thanos-sidecar-config
   namespace: monitoring
 type: Opaque

templates/Service-Grafana.yaml

@@ -6,17 +6,13 @@ metadata:
   name: grafana
   namespace: {{ .Values.nfc_monitoring.grafana.namespace }}
   labels:
-    app.kubernetes.io/component: graphing
+    {{ toYaml $.Values.nfc_monitoring.grafana.labels | nindent 4 }}
-    app.kubernetes.io/instance: k8s
-    app.kubernetes.io/name: grafana
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/version: {{ $.Chart.Version }}
 spec:
   selector:
-    app.kubernetes.io/component: graphing
+    {{ toYaml $.Values.nfc_monitoring.grafana.labels | nindent 4 }}
-    app.kubernetes.io/instance: k8s
-    app.kubernetes.io/name: grafana
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
   #type: NodePort
   #type: LoadBalancer

templates/Service-GrafanaAgent.yaml

@@ -5,17 +5,13 @@ metadata:
   name: grafana-agent
   namespace: monitoring
   labels:
-    app.kubernetes.io/instance: k8s
+    {{ toYaml $.Values.nfc_monitoring.grafana_agent.labels | nindent 4 }}
-    app.kubernetes.io/component: exporter
-    app.kubernetes.io/name: grafana-agent
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/version: {{ $.Chart.Version }}
 spec:
   selector:
-    app.kubernetes.io/instance: k8s
+    {{ toYaml $.Values.nfc_monitoring.grafana_agent.labels | nindent 4 }}
-    app.kubernetes.io/component: exporter
-    app.kubernetes.io/name: grafana-agent
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
   ports:
     - name: grafana-metrics

templates/Service-alertmanager.yaml

@@ -3,9 +3,7 @@ apiVersion: v1
 kind: Service
 metadata:
   labels:
-    app.kubernetes.io/component: alert-router
+    {{ toYaml $.Values.nfc_monitoring.alert_manager.labels | nindent 4 }}
-    app.kubernetes.io/instance: main
-    app.kubernetes.io/name: alertmanager
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/version: {{ $.Chart.Version }}

templates/Service-prometheus-adapter.yaml

@@ -3,9 +3,7 @@ apiVersion: v1
 kind: Service
 metadata:
   labels:
-    app.kubernetes.io/component: metrics-adapter
+    {{ toYaml $.Values.nfc_monitoring.prometheus_adaptor.labels | nindent 4 }}
-    app.kubernetes.io/instance: main
-    app.kubernetes.io/name: prometheus-adapter
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/version: {{ $.Chart.Version }}
@@ -17,7 +15,5 @@ spec:
     port: 443
     targetPort: 6443
   selector:
-    app.kubernetes.io/component: metrics-adapter
+    {{ toYaml $.Values.nfc_monitoring.prometheus_adaptor.labels | nindent 4 }}
-    app.kubernetes.io/instance: main
-    app.kubernetes.io/name: prometheus-adapter
     app.kubernetes.io/part-of: {{ $.Chart.Name }}

templates/Service-prometheus.yaml

@@ -3,9 +3,7 @@ apiVersion: v1
 kind: Service
 metadata:
   labels:
-    app.kubernetes.io/component: prometheus
+    {{ toYaml $.Values.nfc_monitoring.prometheus.labels | nindent 4 }}
-    app.kubernetes.io/instance: k8s
-    app.kubernetes.io/name: prometheus
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/version: {{ $.Chart.Version }}
@@ -20,9 +18,7 @@ spec:
     port: 8080
     targetPort: reloader-web
   selector:
-    app.kubernetes.io/component: prometheus
+    {{ toYaml $.Values.nfc_monitoring.prometheus.labels | nindent 4 }}
-    app.kubernetes.io/instance: k8s
-    app.kubernetes.io/name: prometheus
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
   sessionAffinity: ClientIP
 
@@ -51,9 +47,6 @@ spec:
     port: 10902
     targetPort: 10902
   selector:
-    app.kubernetes.io/component: prometheus
+    {{ toYaml $.Values.nfc_monitoring.prometheus.labels | nindent 4 }}
-    app.kubernetes.io/instance: k8s
-    app.kubernetes.io/name: prometheus
-    app.kubernetes.io/part-of: {{ $.Chart.Name }}
 
 {{ end }}

templates/ServiceAccount-Grafana.yaml

@@ -6,9 +6,7 @@ metadata:
   name: grafana
   namespace: {{ .Values.nfc_monitoring.grafana.namespace }}
   labels:
-    app.kubernetes.io/component: graphing
+    {{ toYaml $.Values.nfc_monitoring.grafana.labels | nindent 4 }}
-    app.kubernetes.io/instance: k8s
-    app.kubernetes.io/name: grafana
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/version: {{ $.Chart.Version }}

templates/ServiceAccount-GrafanaAgent.yaml

@@ -6,9 +6,7 @@ metadata:
   name: grafana-agent
   namespace: monitoring
   labels:
-    app.kubernetes.io/instance: k8s
+    {{ toYaml $.Values.nfc_monitoring.grafana_agent.labels | nindent 4 }}
-    app.kubernetes.io/component: exporter
-    app.kubernetes.io/name: grafana-agent
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/version: {{ $.Chart.Version }}

templates/ServiceAccount-alertmanager.yaml

@@ -4,9 +4,7 @@ automountServiceAccountToken: false
 kind: ServiceAccount
 metadata:
   labels:
-    app.kubernetes.io/component: alert-router
+    {{ toYaml $.Values.nfc_monitoring.alert_manager.labels | nindent 4 }}
-    app.kubernetes.io/instance: main
-    app.kubernetes.io/name: alertmanager
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/version: {{ $.Chart.Version }}

templates/ServiceAccount-prometheus-adapter.yaml

@@ -4,9 +4,7 @@ automountServiceAccountToken: false
 kind: ServiceAccount
 metadata:
   labels:
-    app.kubernetes.io/component: metrics-adapter
+    {{ toYaml $.Values.nfc_monitoring.prometheus_adaptor.labels | nindent 4 }}
-    app.kubernetes.io/instance: main
-    app.kubernetes.io/name: prometheus-adapter
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/version: {{ $.Chart.Version }}

templates/ServiceAccount-prometheus.yaml

@@ -4,9 +4,7 @@ automountServiceAccountToken: true
 kind: ServiceAccount
 metadata:
   labels:
-    app.kubernetes.io/component: prometheus
+    {{ toYaml $.Values.nfc_monitoring.prometheus.labels | nindent 4 }}
-    app.kubernetes.io/instance: k8s
-    app.kubernetes.io/name: prometheus
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/version: {{ $.Chart.Version }}

templates/ServiceMonitor-Grafana.yaml

@@ -3,9 +3,7 @@ apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
   labels:
-    app.kubernetes.io/component: graphing
+    {{ toYaml $.Values.nfc_monitoring.grafana.labels | nindent 4 }}
-    app.kubernetes.io/instance: k8s
-    app.kubernetes.io/name: grafana
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/version: {{ $.Chart.Version }}
@@ -31,7 +29,5 @@ spec:
   jobLabel: app.kubernetes.io/name
   selector:
     matchLabels:
-      app.kubernetes.io/component: graphing
+      {{ toYaml $.Values.nfc_monitoring.grafana.labels | nindent 6 }}
-      app.kubernetes.io/instance: k8s
-      app.kubernetes.io/name: grafana
       app.kubernetes.io/part-of: {{ $.Chart.Name }}

templates/ServiceMonitor-Node.yaml

@@ -35,9 +35,43 @@ spec:
       sourceLabels:
       - __meta_kubernetes_pod_node_name
       targetLabel: node
+    metricRelabelings:
+      - action: drop
+        sourceLabels: [__name__]
+        regex: '(promtail_).*'
+
+  - bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
+    interval: 5s
+    honorLabels: true
+    path: /metrics
+    port: grafana-metrics
+    scheme: http
+    relabelings:
+    - action: replace
+      regex: (.*)
+      replacement: $1
+      sourceLabels:
+      - __meta_kubernetes_pod_node_name
+      targetLabel: instance
+    - targetLabel: "job"
+      replacement: "promtail"
+    - action: replace
+      regex: (.*)
+      replacement: $1
+      sourceLabels:
+      - __meta_kubernetes_pod_node_name
+      targetLabel: node
+    - action: replace
+      separator: /
+      sourceLabels:
+      - namespace
+      - job
+      targetLabel: job
+    metricRelabelings:
+      - action: keep
+        sourceLabels: [__name__]
+        regex: '(promtail_).*'
   selector:
     matchLabels:
-      app.kubernetes.io/instance: k8s
+      {{ toYaml $.Values.nfc_monitoring.grafana_agent.labels | nindent 6 }}
-      app.kubernetes.io/component: exporter
-      app.kubernetes.io/name: grafana-agent
       app.kubernetes.io/part-of: {{ $.Chart.Name }}

templates/ServiceMonitor-node-exporter.yaml

@@ -38,7 +38,5 @@ spec:
       insecureSkipVerify: true
   selector:
     matchLabels:
-      app.kubernetes.io/instance: k8s
+      {{ toYaml $.Values.nfc_monitoring.grafana_agent.labels | nindent 6 }}
-      app.kubernetes.io/component: exporter
-      app.kubernetes.io/name: grafana-agent
       app.kubernetes.io/part-of: {{ $.Chart.Name }}

templates/ServiceMonitor-prometheus-adapter.yaml

@@ -3,9 +3,7 @@ apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
   labels:
-    app.kubernetes.io/component: metrics-adapter
+    {{ toYaml $.Values.nfc_monitoring.prometheus_adaptor.labels | nindent 4 }}
-    app.kubernetes.io/instance: main
-    app.kubernetes.io/name: prometheus-adapter
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/version: {{ $.Chart.Version }}
@@ -33,7 +31,5 @@ spec:
       insecureSkipVerify: true
   selector:
     matchLabels:
-      app.kubernetes.io/component: metrics-adapter
+      {{ toYaml $.Values.nfc_monitoring.prometheus_adaptor.labels | nindent 6 }}
-      app.kubernetes.io/instance: main
-      app.kubernetes.io/name: prometheus-adapter
       app.kubernetes.io/part-of: {{ $.Chart.Name }}

templates/ServiceMonitor-prometheus.yaml

@@ -3,8 +3,7 @@ apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
   labels:
-    app.kubernetes.io/component: prometheus
+    {{ toYaml $.Values.nfc_monitoring.prometheus.labels | nindent 4 }}
-    app.kubernetes.io/name: prometheus
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/version: {{ $.Chart.Version }}
@@ -25,9 +24,7 @@ spec:
     port: reloader-web
   selector:
     matchLabels:
-      app.kubernetes.io/component: prometheus
+      {{ toYaml $.Values.nfc_monitoring.prometheus.labels | nindent 6 }}
-      app.kubernetes.io/instance: k8s
-      app.kubernetes.io/name: prometheus
       app.kubernetes.io/part-of: {{ $.Chart.Name }}
 
 {{ if .Values.nfc_monitoring.thanos.sidecar.enabled }}

templates/serviceMonitor-alertmanager.yaml

@@ -3,9 +3,7 @@ apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
   labels:
-    app.kubernetes.io/component: alert-router
+    {{ toYaml $.Values.nfc_monitoring.alert_manager.labels | nindent 4 }}
-    app.kubernetes.io/instance: main
-    app.kubernetes.io/name: alertmanager
     app.kubernetes.io/part-of: {{ $.Chart.Name }}
     app.kubernetes.io/managed-by: {{ $.Release.Service }}
     app.kubernetes.io/version: {{ $.Chart.Version }}
@@ -23,7 +21,5 @@ spec:
     - "{{ .Values.nfc_monitoring.alert_manager.namespace }}"
   selector:
     matchLabels:
-      app.kubernetes.io/component: alert-router
+      {{ toYaml $.Values.nfc_monitoring.alert_manager.labels | nindent 6 }}
-      app.kubernetes.io/instance: main
-      app.kubernetes.io/name: alertmanager
       app.kubernetes.io/part-of: {{ $.Chart.Name }}

values.yaml

@@ -15,22 +15,98 @@ nfc_monitoring:
     image: 
       name: quay.io/prometheus/alertmanager
       tag: 'v0.26.0'
+
+
+    ingress:
+      annotations:
+        cert-manager.io/cluster-issuer: "selfsigned-issuer"
+        nginx.ingress.kubernetes.io/ssl-redirect: "true"
+      # enabled: false # Optional, boolean.
+      spec:
+        tls:
+          - hosts:
+              - alert-manager.local
+            secretName: certificate-tls-alert-manager
+        rules:
+          - host:  alert-manager.local
+            http:
+              paths:
+                - path: /
+                  pathType: Prefix
+                  backend:
+                    service:
+                      name: alertmanager-main
+                      port:
+                        name: web
+    
+    labels:
+      app.kubernetes.io/instance: main
+      app.kubernetes.io/component: alert-router
+      app.kubernetes.io/name: alertmanager
+
     namespace: alerting
 
 
   grafana:
 
-    admin_user: admin
+    # Grafana Configuration
-    admin_password: admin
+    # Type: Dict
+    # See: https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana
+    config:
+      analytics:
+        enabled: 'false'
+      # database:
+      #   type: mysql
+      #   host: mariadb-galera.mariadb.svc:3306
+      #   name: grafana
+      #   user: root
+      #   password: admin
+
+      log:
+        mode: "console"
+      auth:
+        disable_login_form: "false"
+      security:
+        admin_user: admin
+        admin_password: admin
 
     image: 
       name: grafana/grafana
       tag: '10.1.2' # '10.0.5'
 
+    ingress:
+      annotations:
+        cert-manager.io/cluster-issuer: "selfsigned-issuer"
+        nginx.ingress.kubernetes.io/ssl-redirect: "true"
+      # enabled: false # Optional, boolean.
+      spec:
+        tls:
+          - hosts:
+              - grafana.local
+            secretName: certificate-tls-grafana
+        rules:
+          - host:  grafana.local
+            http:
+              paths:
+                - path: /
+                  pathType: Prefix
+                  backend:
+                    service:
+                      name: grafana
+                      port:
+                        name: grafana-http
+
+    labels:
+      app.kubernetes.io/component: graphing
+      app.kubernetes.io/instance: k8s
+      app.kubernetes.io/name: grafana
+
     namespace: grafana
 
     replicas: 1
 
+    # storage_accessModes: ReadWriteMany
+
     affinity: 
       nodeAffinity:
         preferredDuringSchedulingIgnoredDuringExecution:
@@ -93,23 +169,23 @@ nfc_monitoring:
       #     prometheusType: Mimir
       #   editable: true
 
-      - name: prometheus
+      # - name: prometheus
-        type: prometheus
+      #   type: prometheus
-        access: proxy
+      #   access: proxy
-        url: "http://prometheus-k8s.{{ .Values.nfc_monitoring.prometheus.namespace }}.svc:9090"
+      #   url: "http://prometheus-k8s.{{ .Values.nfc_monitoring.prometheus.namespace }}.svc:9090"
-        isDefault: true
+      #   isDefault: true
-        jsonData:
+      #   jsonData:
-          manageAlerts: true
+      #     manageAlerts: true
-          orgId: 1
+      #     orgId: 1
-          prometheusType: Prometheus
+      #     prometheusType: Prometheus
-          prometheusVersion: 2.42.0
+      #     prometheusVersion: 2.42.0
-        editable: true
+      #   editable: true
 
       - name: thanos
         type: prometheus
         access: proxy
         url: "http://thanos-query.metrics.svc:9090"
-        isDefault: false
+        isDefault: true
         jsonData:
           manageAlerts: true
           orgId: 1
@@ -122,6 +198,12 @@ nfc_monitoring:
     image: 
       name: grafana/agent
       tag: 'v0.36.1'
+
+    labels:
+      app.kubernetes.io/instance: k8s
+      app.kubernetes.io/component: exporter
+      app.kubernetes.io/name: grafana-agent
+
     namespace: monitoring
 
 
@@ -170,6 +252,34 @@ nfc_monitoring:
       name: prom/prometheus
       tag: 'v2.47.0'
 
+    ingress:
+      annotations:
+        cert-manager.io/cluster-issuer: "selfsigned-issuer"
+        nginx.ingress.kubernetes.io/ssl-redirect: "true"
+      # enabled: false # Optional, boolean.
+      spec:
+        tls:
+          - hosts:
+              - prometheus.local
+            secretName: certificate-tls-prometheus
+        rules:
+          - host:  prometheus.local
+            http:
+              paths:
+                - path: /
+                  pathType: Prefix
+                  backend:
+                    service:
+                      name: prometheus-k8s
+                      port:
+                        name: web
+    
+    # These labels are appended to all Prometheus items and are also the selector labels
+    labels:
+      app.kubernetes.io/component: prometheus
+      app.kubernetes.io/instance: k8s
+      app.kubernetes.io/name: prometheus
+
     namespace: monitoring
 
     affinity: 
@@ -232,12 +342,18 @@ nfc_monitoring:
     # Additional settings for Prometheus.
     # See: https://prometheus-operator.dev/docs/operator/api/#monitoring.coreos.com/v1.PrometheusSpec
     # Type: dict
-    additional: {}
+    additional:
 
       # remoteWrite: 
       #   - name: mimir
       #     url: http://mimir-gateway.metrics.svc.cluster.local/api/v1/push
 
+      retention: 24h
+      retentionSize: 20GB
+      ruleSelector:
+        matchLabels:
+          role: alert-rules
+
 
   prometheus_adaptor:
 
@@ -245,6 +361,11 @@ nfc_monitoring:
       name: registry.k8s.io/prometheus-adapter/prometheus-adapter
       tag: 'v0.11.1'
 
+    labels:
+      app.kubernetes.io/component: metrics-adapter
+      app.kubernetes.io/instance: main
+      app.kubernetes.io/name: prometheus-adapter
+
     namespace: monitoring
 
     affinity: 
@@ -291,6 +412,7 @@ nfc_monitoring:
           endpoint: "rook-ceph-rgw-earth.ceph.svc:80"
           access_key: "7J5NM2MNCDB4T4Y9OKJ5"
           secret_key: "t9r69RzZdWEBL3NCKiUIpDk6j5625xc6HucusiGG"
+          insecure: true
 
 
   additions:
@@ -322,6 +444,282 @@ nfc_monitoring:
       label_value: "1"
 
 
+  network_policy:
+    
+    enabled: true
+
+    # Network Policies to apply. These policies are automagically build using the values below.
+    # What you would find under path root.spec belongs here.
+    # 
+    # Do:
+    #   - Define 'Ingress'
+    #   - Define 'Egress'
+    #   - Ensure that the name matches the item name from values.yaml. i.e. nfc_monitoring.{item_name}
+    #     for prometheus the item name is 'prometheus'. This value is used to select items pertaining to
+    #     that item from values.yaml. for example the labels and namespace.
+    # Dont:
+    #   - Define 'podSelector' as this is alreaady included using the selector labels
+    policies:
+
+### SoF Network Policy: Prometheus ###
+
+      - name: prometheus
+        policy:
+          egress: # ToDo: add further restrictions to egress. is variable lookup possible to obtain values????
+              # - {}
+            - to: # Alert Manager
+                - namespaceSelector:
+                    matchLabels:
+                      kubernetes.io/metadata.name: alerting
+                  podSelector:
+                    matchLabels:
+                      app.kubernetes.io/instance: main
+                      app.kubernetes.io/component: alert-router
+                      app.kubernetes.io/name: alertmanager
+              ports:
+                - port: 9093
+                  protocol: TCP
+
+            - to: # Ceph
+                - ipBlock:
+                    cidr: 172.16.10.0/24
+              ports:
+                - port: 9283
+                  protocol: TCP
+
+            - to: # Grafana
+                - namespaceSelector:
+                    matchLabels:
+                      kubernetes.io/metadata.name: grafana
+                  podSelector:
+                    matchLabels:
+                      app.kubernetes.io/component: graphing
+                      app.kubernetes.io/instance: k8s
+                      app.kubernetes.io/name: grafana
+              ports:
+                - port: 3000
+                  protocol: TCP
+
+            - to: # Grafana Agent
+                - namespaceSelector:
+                    matchLabels:
+                      kubernetes.io/metadata.name: monitoring
+                  podSelector:
+                    matchLabels:
+                      app.kubernetes.io/instance: k8s
+                      app.kubernetes.io/component: exporter
+                      app.kubernetes.io/name: grafana-agent
+              ports:
+                - port: 12345
+                  protocol: TCP
+
+            - to: # Kube DNS
+                - namespaceSelector:
+                    matchLabels:
+                      kubernetes.io/metadata.name: kube-system
+                  podSelector:
+                    matchLabels:
+                      k8s-app: kube-dns
+              ports:
+                - port: 53
+                  protocol: TCP
+                - port: 53
+                  protocol: UDP
+
+            - to:
+                - podSelector:
+                    matchLabels:
+                      app.kubernetes.io/name: prometheus
+                  # namespaceSelector:
+                  #   matchLabels:
+                  #     kubernetes.io/metadata.name: monitoiring
+                - namespaceSelector:
+                    matchLabels:
+                      kubernetes.io/metadata.name: metrics
+              ports: []
+
+            - {} # ToDo: Temp rule: Allow All. this rule MUST be removed when egress has been refactored
+
+          ingress: 
+
+            - from:
+                - podSelector:
+                    matchLabels:
+                      app.kubernetes.io/name: prometheus
+                  # namespaceSelector:
+                  #   matchLabels:
+                  #     kubernetes.io/metadata.name: monitoiring
+                - namespaceSelector:
+                    matchLabels:
+                      kubernetes.io/metadata.name: metrics
+              ports: []
+                # - port: 8080
+                #   protocol: TCP
+                # - port: 9090
+                #   protocol: TCP
+                # - port: 10901
+                #   protocol: TCP
+
+            - from:
+                - podSelector:
+                    matchLabels:
+                      app.kubernetes.io/name: grafana
+                  namespaceSelector:
+                    matchLabels:
+                      kubernetes.io/metadata.name: grafana
+                - podSelector:
+                    matchLabels:
+                      app.kubernetes.io/name: prometheus-adapter
+                  namespaceSelector:
+                    matchLabels:
+                      kubernetes.io/metadata.name: monitoring
+              ports:
+                - port: 9090
+                  protocol: TCP
+
+            - from: []
+              ports: []
+
+          policyTypes:
+          - Egress
+          - Ingress
+
+### SoF Network Policy: Grafana ###
+
+      - name: grafana
+        policy:
+            egress:
+
+              - to:
+                  - namespaceSelector:
+                      matchLabels:
+                        kubernetes.io/metadata.name: alerting
+                    podSelector:
+                      matchLabels:
+                        app.kubernetes.io/instance: main
+                        app.kubernetes.io/component: alert-router
+                        app.kubernetes.io/name: alertmanager
+                ports:
+                  - port: 9093
+                    protocol: TCP
+
+              - to:
+                  - namespaceSelector:
+                      matchLabels:
+                        kubernetes.io/metadata.name: logging
+                    podSelector:
+                      matchLabels:
+                        app.kubernetes.io/component: gateway
+                        app.kubernetes.io/instance: loki
+                        app.kubernetes.io/name: loki
+                ports:
+                  - port: 80       # Service Port
+                    protocol: TCP
+                  - port: 8080     # Pod Port
+                    protocol: TCP
+
+              - to:
+                  - namespaceSelector:
+                      matchLabels:
+                        kubernetes.io/metadata.name: monitoring
+                    podSelector:
+                      matchLabels:
+                        app.kubernetes.io/component: prometheus
+                        app.kubernetes.io/instance: k8s
+                        app.kubernetes.io/name: prometheus
+                  - namespaceSelector:
+                      matchLabels:
+                        kubernetes.io/metadata.name: metrics
+                    podSelector:
+                      matchLabels:
+                        app.kubernetes.io/component: query-layer
+                        app.kubernetes.io/instance: thanos-query
+                        app.kubernetes.io/name: thanos-query
+                ports:
+                  - port: 9090
+                    protocol: TCP
+
+              - to: [] # Requires internet access for plugins and dashboard downloading
+                ports:
+                  - port: 443
+                    protocol: TCP
+
+              - to: # Kube DNS
+                  - namespaceSelector:
+                      matchLabels:
+                        kubernetes.io/metadata.name: kube-system
+                    podSelector:
+                      matchLabels:
+                        k8s-app: kube-dns
+                ports:
+                  - port: 53
+                    protocol: TCP
+                  - port: 53
+                    protocol: UDP
+
+            ingress:
+
+              - from: []
+                ports:
+                  - port: 3000
+                    protocol: TCP
+            policyTypes:
+              - Egress
+              - Ingress
+
+### SoF Network Policy: Grafana Agent ###
+
+      - name: grafana_agent
+        policy:
+          egress:
+
+            - to: # Logging
+                - namespaceSelector:
+                    matchLabels:
+                      kubernetes.io/metadata.name: logging
+                  podSelector:
+                    matchLabels:
+                      app.kubernetes.io/component: gateway
+                      app.kubernetes.io/instance: loki
+                      app.kubernetes.io/name: loki
+              ports:
+                - port: 80
+                  protocol: TCP
+
+            - to: # Kube DNS
+                - namespaceSelector:
+                    matchLabels:
+                      kubernetes.io/metadata.name: kube-system
+                  podSelector:
+                    matchLabels:
+                      k8s-app: kube-dns
+              ports:
+                - port: 53
+                  protocol: TCP
+                - port: 53
+                  protocol: UDP
+
+          ingress:
+
+            - from: 
+                - namespaceSelector:
+                    matchLabels:
+                      kubernetes.io/metadata.name: monitoring
+                  podSelector:
+                    matchLabels:
+                      app.kubernetes.io/component: prometheus
+                      app.kubernetes.io/instance: k8s
+                      app.kubernetes.io/name: prometheus
+              ports:
+                - port: 12345
+                  protocol: TCP
+
+          policyTypes:
+          - Egress
+          - Ingress
+
+
+
 loki_instance:
   image: 
     name: grafana/loki