monitoring: add zone, and cluster name

renamed:    cluster/repositories/casa-limbosolutions-com/certificate.yaml -> cluster/repos/casa-limbosolutions-com/certificate.yaml
renamed:    cluster/repositories/casa-limbosolutions-com/deploy/flux/.env.d/.gitignore -> cluster/repos/casa-limbosolutions-com/deploy/flux/.env.d/.gitignore
renamed:    cluster/repositories/casa-limbosolutions-com/deploy/flux/git-repo.yaml -> cluster/repos/casa-limbosolutions-com/deploy/flux/git-repo.yaml
renamed:    cluster/repositories/casa-limbosolutions-com/deploy/flux/kustomization.yaml -> cluster/repos/casa-limbosolutions-com/deploy/flux/kustomization.yaml
renamed:    cluster/repositories/myinfra-kubernetes-shared/git-repo.yaml -> cluster/repos/myinfra-kubernetes-shared/git-repo.yaml
renamed:    cluster/repositories/myinfra-kubernetes-shared/kustomization.yaml -> cluster/repos/myinfra-kubernetes-shared/kustomization.yaml

.devcontainer/devcontainer.json

@@ -12,6 +12,7 @@
 		"source=${localWorkspaceFolder}/../myLimbo.Jellyfin,target=/workspaces/myLimbo.Jellyfin,type=bind",
 		"source=${localWorkspaceFolder}/../kb,target=/workspaces/kb,type=bind",
 		"source=${localWorkspaceFolder}/../pi.bluetooth.speaker,target=/workspaces/pi.bluetooth.speaker,type=bind",
+		"source=${localWorkspaceFolder}/../myinfra.kubernetes.shared,target=/workspaces/myinfra.kubernetes.shared,type=bind",
 		"source=${localWorkspaceFolder}/.env.d/kube,target=/home/vscode/.kube,type=bind",
 		"source=${localEnv:HOME}/.gitconfig,target=/home/vscode/.gitconfig,type=bind,consistency=cached",
   		"source=${localEnv:HOME}/.ssh,target=/home/vscode/.ssh,type=bind,consistency=cached"

casa.full-stack.code-workspace

@@ -18,6 +18,11 @@
 			"name": "Jellyfin",
 			"path": "../myLimbo.Jellyfin"
 		},
+		
+		{
+			"name": "myinfra.kubernetes.shared",
+			"path": "../myinfra.kubernetes.shared"
+		},
 		{
 			"name": "kb",
 			"path": "../kb"

cluster/monitoring/alloy-global-sync.yaml

@@ -1,14 +1,14 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: alloy
+  name: alloy-global
 spec:
   interval: 1m
   sourceRef:
     kind: GitRepository
     name: casa
     namespace: casa-limbosolutions-com
-  path: services/monitoring/deploy/alloy
+  path: services/monitoring/alloy-global
   prune: true
   decryption:
     provider: sops

cluster/monitoring/kustomization.yaml

@@ -2,8 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: monitoring
 resources:
- - flux-kustomization-alloy.yaml
- - flux-kustomization-prometheus.yaml 
+ - alloy-global-sync.yaml
+ - myinfra-kubernetes-shared-monitoring-sync.yaml
 secretGenerator:
   - name: flux-sops-age
     files:

cluster/monitoring/myinfra-kubernetes-shared-monitoring-sync.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: myinfra-kubernetes-shared-monitoring
+spec:
+  interval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: myinfra-kubernetes-shared
+    namespace: casa-limbosolutions-com
+  path: monitoring/overlays/complete-stack
+  prune: true

cluster/repos/myinfra-kubernetes-shared/git-repo.yaml

@@ -0,0 +1,9 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: myinfra-kubernetes-shared
+spec:
+  interval: 1m0s
+  url: https://git.limbosolutions.com/myLimbo/myinfra.kubernetes.shared.git
+  ref:
+    branch: main

cluster/repos/myinfra-kubernetes-shared/kustomization.yaml

@@ -1,9 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: monitoring
+namespace: casa-limbosolutions-com
 resources:
-  - global
-  - node-scraper
-  - kube-scraper   
+ - git-repo.yaml
 generatorOptions:
   disableNameSuffixHash: true

services/monitoring/README.md

@@ -2,16 +2,8 @@
 
 ## alloy
 
-**promtail Encrypt secrets:**
+**Encrypt global secrets:**
 
 ``` bash
-sops -e deploy/alloy/global/secrets.dec.yaml > deploy/alloy/global/secrets.yaml 
+sops -e alloy-global/secrets.dec.yaml > alloy-global/secrets.yaml 
 ```
-
-**Check agent:**
-
-``` bash
-http://localhost:9090/agent
-```
-
-## prometheus - kube-state-metrics

services/monitoring/alloy-global/kustomization.yaml

@@ -3,6 +3,5 @@ kind: Kustomization
 namespace: monitoring
 resources:
   - secrets.yaml
-  - grafana-helm-repo.yaml
 generatorOptions:
   disableNameSuffixHash: true

services/monitoring/alloy-global/secrets.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: alloy-global
+stringData:
+    loki_url: ENC[AES256_GCM,data:77WX9WmaQSCgXmU1NxBwjCyY+67innPetnjAvrCY2GRC9jCg3fH5ul0oq9tmh591MH+Jm3PqWyjaDew=,iv:x3sRiuVs3x4KKR8ZApvA87ZyiNzNrXDJ7/9p0KUMMqI=,tag:pdSxPi+XiGF/ZqjKYst/bA==,type:str]
+    prometheus_url: ENC[AES256_GCM,data:BBmLjjl0k7J1PkvDiIp3eHzcwqFjOHAGHOhAuNox+fGXwp+bBb/ZABqmCLTFEPMIDUc+FeCr4W3Q4J6AhQ==,iv:WnJAehA6+3l3Fu2T7Zg9OtTYFkwAC5w4MNya4hBiUpk=,tag:+LW3URk3gEUZfagwOhs5qg==,type:str]
+    zone: ENC[AES256_GCM,data:xPRm2s/Kc0lf,iv:YzimQNvQrEuA1A6saA977uHkGa83Z+9ey+QA6aYY22o=,tag:jg/2hix9bm6wkiXBgpd/AQ==,type:str]
+    cluster_name: ENC[AES256_GCM,data:kw0RVQ==,iv:Xf7GCffqPb9Zxj0+WfRLx13W7LU/7Cx8Skjui9bwRTs=,tag:wz+OTyhb3HQcMQqjG/Mreg==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrdnZDb0lwc0ZvaWlIYzJs
+            ZVhJdnkvSVRlSUM1bUpocmNGRzkxUnZPdDJZClI2V2tLZ1pvY3U5NFRYYzE1VUdG
+            NFdpTE43U0tkTEF0cG5GRkhobEhteVEKLS0tIGZ2YVpjTHFrSVRhNURFZkJJQUxs
+            UTdKZGlLUkp2b21YRzVtdEQ2ZmdFN3MKjrJqtfMVd5t2qnDqio7cYRC3Ntpf2Gdk
+            NtPQw32lG8oFKBn1rDPI/ZkY/wqEPd2PLrnW9o5mzUcjltlVpWkKMw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1f9e4pvp5y8gzuk8mz2s5xm85dd7znxhk56tcpuxqwn78qfjwja0qekwlju
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-09-12T15:08:17Z"
+    mac: ENC[AES256_GCM,data:8nLBCFCEICcqD4dxEFMPbpWJnVCKOH7NIfgQbsKix5rog1uUT5LR3/ZmEDpT3PWUmnCUEECWcwno4JZ7zfmNp0R3IpxAQESaA32SJBgiZwyMgQCKIORUBDIZG2vZ5miQmFgsBRIbS+o5HPILJWFBf9KOaEaE2w/24i5HCnhEO3c=,iv:Bp2wRfhV3YX+8IVW3mg7Shx0+pv18owVn0eMt0srABE=,tag:I1xMjQym63sT/iwErN4kRA==,type:str]
+    version: 3.13.1

services/monitoring/deploy/alloy/global/grafana-helm-repo.yaml

@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: grafana
-spec:
-  interval: 24h
-  url: https://grafana.github.io/helm-charts
-       

services/monitoring/deploy/alloy/global/secrets.yaml

@@ -1,22 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: alloy-global
-stringData:
-    loki_url: ENC[AES256_GCM,data:2DeZZ+7deDbojQ/+YNgT8KwDmjFFyAqMcTX8l6itlF15hilXKgYP1p/SNoyw1JGJ7x5VZqUl0VIVhVY=,iv:SlFiLvEeIqj+zQ/8Jspc9FL/ElneIlWBzGsM+6mGZLc=,tag:9tIl6fi+xfmF+TJpMXgbKg==,type:str]
-    prometheus_url: ENC[AES256_GCM,data:k8Z3lvZRxOmlw6Wx4aLAgV93hPcEawtoprWU2Kn6j/WIe/YDHM9iuB+pRy7ght4I6jxyNFLotN0BaHE1yg==,iv:EEnRoS287e9EV8+25NtlEO31zN0eyfRBOUe9GVBah18=,tag:2K/MnM1QlWPbceQBqCwylw==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJYmx1dGJTSGZvbVdpV1di
-            Z3dKNUJPVGNkK1hBSnVoRXZrb0R4TmxnUjM4CmpyUXpGN2lneDViN3VPNC9Fa3d6
-            RURxZTFuV0o1SzF5ZEhzSVZyYkY5alkKLS0tIEF1T0tINnRUa0tDOGlaSVRJajF5
-            bTFTd0c4Z3p1aUNWWTZ0ZFVXQVdrMjAKku2YU048qf4E9vEPO19HNfAg78E3fSFQ
-            WBiUgiqtqG/T4cI5cf4CUWoUogtABawBG4z5G5+ud7sfVMzfqW+W1g==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1f9e4pvp5y8gzuk8mz2s5xm85dd7znxhk56tcpuxqwn78qfjwja0qekwlju
-    encrypted_regex: ^(data|stringData)$
-    lastmodified: "2026-08-30T22:14:34Z"
-    mac: ENC[AES256_GCM,data:XQ2zRn6zGBONfBiyaip3DpwzIfDBN1mPI65fVfH3c7tsEeY1mV/ZRPD+5iJsiwxlnBa7Rq0iJNOr2f84JE+CiuqYz8UKuQMS02gsvqXuBSgUn5vDRcX/aBV3+1GSOzv3ilmwMkJI/jxfyyXL4YsxKl0fsFEOJRsa3VCCVF0OvrM=,iv:enk8h+TfYBIOFln3SlOw30arg2T/kSU3IMwusrm68Qc=,tag:yp9eQc56Ht6g3x3QnMqMZg==,type:str]
-    version: 3.13.1

services/monitoring/deploy/alloy/kube-scraper/helm-release.yaml

@@ -1,24 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: alloy-kube-scraper
-spec:
-  releaseName: alloy-kube-scraper
-  interval: 1m
-  chart:
-    spec:
-      chart: alloy
-      version: 1.x.x
-      sourceRef:
-        kind: HelmRepository
-        name: grafana
-      interval: 40h
-  valuesFrom:
-    - kind: Secret
-      name: alloy-kube-scraper-helm-values
-      valuesKey: values.yaml
-
-
-
-
-

services/monitoring/deploy/alloy/kube-scraper/helm-values.yaml

@@ -1,373 +0,0 @@
-controller:
-  type: 'deployment'
-  nodeSelector:
-    kubernetes.io/hostname: casa-minion-01
-alloy:
-
-  # https://grafana.com/docs/alloy/latest/collect/logs-in-kubernetes/
-  configMap:
-    content: |
-      logging {
-        level = "warn"
-      }
-
-      // ============================================
-      // Discovery: Kubernetes - Nodes
-      // used by:
-      // - prometheus - Kube_node_metrics - cAdvisor 
-      // ============================================
-      
-      discovery.kubernetes "kube_nodes" {
-        role = "node"
-      }
-
-      // ============================================
-      // Discovery: Kubernetes - pods
-      // used by:
-      // - loki kubernetes pod logs
-      // ============================================
-      
-      discovery.kubernetes "kube_pods" {
-        role = "pod"
-      }
-
-      // ============================================
-      // Discovery: Kubernetes - services
-      // used by:
-      // - loki kubernetes kube state metrics
-      // ============================================
-      discovery.kubernetes "kube_services" {
-        role = "service"
-      }
-      
-      // ============================================
-      // Discovery: Kubernetes - endpoints
-      // used by:
-      // - loki kubernetes kube state metrics
-      // ============================================
-      discovery.kubernetes "kube_endpoints" {
-        role = "endpoints"
-      }
-
-      // ============================================
-      // Metrics: Prometheus Remote Write 
-      // ============================================
-      prometheus.remote_write "prometheus_srv" {
-        endpoint {
-          url = sys.env("PROMETHEUS_URL")
-        }
-        external_labels = {
-          cluster = sys.env("CLUSTER_NAME"),
-          zone    = sys.env("ZONE"),
-        }
-      }
-
-      discovery.relabel "kubelet" {
-        targets = discovery.kubernetes.kube_nodes.targets
-
-        rule {
-          regex  = ".*_uid$|.*_id$|^annotation_.*|^label_.*|^endpoint_.*|^pod_ip$"
-          action = "drop"
-        }
-
-        rule {
-          regex  = "container_fs_.*|container_network_.*|container_hugetlb_.*|container_blkio_.*|container_tasks_state_.*"
-          action = "drop"
-        }
-
-  
-        // duplicate metrics from cAdviser
-        rule {
-          regex  = "container_cpu_usage_seconds_total|container_memory_working_set_bytes|container_memory_rss|container_memory_cache"
-          action = "drop"
-        }
-
-        rule {
-          source_labels = ["__meta_kubernetes_node_address_InternalIP"]
-          target_label  = "__address__"
-          replacement   = "$1:10250"
-        }
-        
-        rule {
-          action        = "replace"
-          source_labels = ["__meta_kubernetes_node_name"]
-          regex         = "(.+)"
-          target_label  = "node"
-        }
-
-        rule {
-          source_labels = ["node"]
-          target_label = "host"
-        }
-
-
-        rule {
-          target_label = "__metrics_path__"
-          replacement  = "/metrics"
-        }
-
-        rule {
-          target_label = "cluster"
-          replacement  = sys.env("CLUSTER_NAME")
-        }
-
-        rule {
-          target_label = "zone"
-          replacement  = sys.env("ZONE")
-        }
-      }
-
-
-      prometheus.scrape "kubelet" {
-        job_name = "integrations/kubernetes/kubelet"
-        targets  = discovery.relabel.kubelet.output
-
-        scheme = "https"
-        metrics_path = "/metrics"
-
-        tls_config {
-          server_name          = "kubernetes"
-          ca_file              = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
-          insecure_skip_verify = true
-        }
-
-        bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
-
-        forward_to = [prometheus.remote_write.prometheus_srv.receiver]
-      }
-
-      // ===============================================================================
-      // prometheus / Metrics - Scrape kube_state_metrics
-      // Requirements: 
-      //  - discovery.relabel - kube_state_metrics
-      // ===============================================================================
-      prometheus.scrape "kube_state_metrics" {
-        job_name = "integrations/kubernetes/kube-state-metrics"
-        targets  = discovery.relabel.kube_state_metrics.output
-
-        scheme = "http"
-
-        forward_to = [prometheus.remote_write.prometheus_srv.receiver]
-      }
-
-      discovery.relabel "kube_state_metrics" {
-        targets = discovery.kubernetes.kube_endpoints.targets
-
-        rule {
-          source_labels = ["__meta_kubernetes_service_name"]
-          regex         = "kube-state-metrics"
-          action        = "keep"
-        }
-
-        rule {
-          regex  = ".*_uid$|.*_id$|^annotation_.*|^label_.*|^endpoint_.*|^pod_ip$"
-          action = "drop"
-        }
-
-        rule {
-          target_label = "cluster"
-          replacement  = sys.env("CLUSTER_NAME")
-        }
-
-        rule {
-          target_label = "zone"
-          replacement  = sys.env("ZONE")
-        }
-      }
-
-
-      // ===============================================================================
-      // Scrape Kubernetes pods containers metrics / cAdvisor
-      // Requirements: 
-      //  - discovery.relabel - kube_node_metrics
-      // ===============================================================================
-
-      prometheus.scrape "cadvisor" {
-        job_name = "integrations/kubernetes/cadvisor"
-        targets  = discovery.relabel.kube_node_metrics.output
-        scheme   = "https"
-
-        tls_config {
-          server_name          = "kubernetes"
-          ca_file              = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
-          insecure_skip_verify = true
-        }
-
-        bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
-        forward_to        = [prometheus.remote_write.prometheus_srv.receiver]
-      }
-  
-
-
-      // ===========================================================
-      // Discovery:relabel: kube_node_metrics (cAdviser)
-      // Requirements: 
-      //  - discovery.kubernetes.role.node: kube_nodes
-      // ===========================================================
-
-       discovery.relabel "kube_node_metrics" {
-        targets = discovery.kubernetes.kube_nodes.targets
-
-        rule {
-          regex  = ".*_uid$|.*_id$|^annotation_.*|^label_.*|^endpoint_.*|^pod_ip$"
-          action = "drop"
-        }
-
-        rule {
-          action        = "replace"
-          source_labels = ["__meta_kubernetes_node_name"]
-          regex         = "(.+)"
-          target_label  = "node"
-        }
-
-        rule {
-          source_labels = ["node"]
-          target_label = "host"
-        }
-
-        rule {
-          replacement  = "/metrics/cadvisor"
-          target_label = "__metrics_path__"
-        }
-
-        rule {
-          target_label = "cluster"
-          replacement  = sys.env("CLUSTER_NAME")
-        }
-
-        rule {
-          target_label = "zone"
-          replacement  = sys.env("ZONE")
-        }
-      }
-
-      // ============================================
-      // API Server discovery
-      // ============================================
-
-      discovery.relabel "apiserver" {
-        targets = discovery.kubernetes.kube_services.targets
-
-        rule {
-          source_labels = ["__meta_kubernetes_service_name"]
-          regex         = "kubernetes"
-          action        = "keep"
-        }
-
-        rule {
-          regex  = ".*_uid$|.*_id$|^annotation_.*|^label_.*|^endpoint_.*|^pod_ip$"
-          action = "drop"
-        }
-
-        rule {
-          regex  = "apiserver_flowcontrol_.*|apiserver_envelope_.*"
-          action = "drop"
-        }
-     
-        rule {
-          target_label = "cluster"
-          replacement  = sys.env("CLUSTER_NAME")
-        }
-
-        rule {
-          target_label = "zone"
-          replacement  = sys.env("ZONE")
-        }
-      }
-
-      prometheus.scrape "apiserver" {
-        job_name = "integrations/kubernetes/apiserver"
-        targets  = discovery.relabel.apiserver.output
-
-        scheme = "https"
-        metrics_path = "/metrics"
-
-        tls_config {
-          server_name          = "kubernetes"
-          ca_file              = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
-          insecure_skip_verify = true
-        }
-
-        bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
-
-        forward_to = [prometheus.remote_write.prometheus_srv.receiver]
-      }
-      
-      // ============================================
-      // CoreDNS discovery (ENDPOINTS)
-      // ============================================
-
-      discovery.relabel "coredns" {
-        targets = discovery.kubernetes.kube_endpoints.targets
-
-        rule {
-          source_labels = ["__meta_kubernetes_service_name"]
-          regex         = "(kube-dns|coredns)"
-          action        = "keep"
-        }
-
-        rule {
-          regex  = ".*_uid$|.*_id$|^annotation_.*|^label_.*|^endpoint_.*|^pod_ip$"
-          action = "drop"
-        }
-
-        rule {
-          regex  = "coredns_cache_.*|coredns_forward_.*"
-          action = "drop"
-        }
-
-        rule {
-          source_labels = ["__meta_kubernetes_endpoint_node_name"]
-          target_label  = "node"
-        }
-
-        rule {
-          action        = "replace"
-          target_label  = "__address__"
-          replacement   = "$__meta_kubernetes_endpoint_address:9153"
-        }
-
-        rule {
-          target_label = "cluster"
-          replacement  = sys.env("CLUSTER_NAME")
-        }
-
-        rule {
-          target_label = "zone"
-          replacement  = sys.env("ZONE")
-        }
-
-      }
-
-      // ============================================
-      // CoreDNS scrape
-      // ============================================
-      prometheus.scrape "coredns" {
-        job_name = "integrations/kubernetes/coredns"
-        targets  = discovery.relabel.coredns.output
-
-        scheme = "http"
-        metrics_path = "/metrics"
-
-        forward_to = [prometheus.remote_write.prometheus_srv.receiver]
-      }
-
-
-  extraEnv:
-
-    - name: CLUSTER_NAME
-      value: casa
-    - name: ZONE
-      value: casa-vlan
-
-    - name: LOKI_URL
-      valueFrom:
-        secretKeyRef:
-          name: alloy-global
-          key: loki_url
-
-    - name: PROMETHEUS_URL
-      valueFrom:
-        secretKeyRef:
-          name: alloy-global
-          key: prometheus_url

services/monitoring/deploy/alloy/kube-scraper/kustomization.yaml

@@ -1,11 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: monitoring
-resources:
-  - helm-release.yaml
-secretGenerator:
-  - name: alloy-kube-scraper-helm-values
-    files:
-      - values.yaml=helm-values.yaml
-generatorOptions:
-  disableNameSuffixHash: true

services/monitoring/deploy/alloy/node-scraper/helm-release.yaml

@@ -1,24 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: alloy-node-scraper
-spec:
-  releaseName: alloy-node-scraper
-  interval: 1m
-  chart:
-    spec:
-      chart: alloy
-      version: 1.x.x
-      sourceRef:
-        kind: HelmRepository
-        name: grafana
-      interval: 40h
-  valuesFrom:
-    - kind: Secret
-      name: alloy-node-scraper-helm-values
-      valuesKey: values.yaml
-
-
-
-
-

services/monitoring/deploy/alloy/node-scraper/helm-values.yaml

@@ -1,236 +0,0 @@
-controller:
-  nameOverride: "alloy-node-scrapper"
-  volumes:
-    extra:
-      # requires host journal configuration storage = volatile
-      - name: run-log-journal
-        hostPath:
-          path: /run/log/journal
-      # Log scrapers (e.g., Alloy/Loki) read this ID from the journal metadata and use it to separate log streams per machine.
-      - name: etc-machine-id
-        hostPath:
-          path: /etc/machine-id
-      - name: rootfs
-        hostPath:
-          path: /
-      - name: proc
-        hostPath:
-          path: /proc
-      - name: sys
-        hostPath:
-          path: /sys
-      - name: dev
-        hostPath:
-          path: /dev
-
-  tolerations:
-    - key: "node-role.kubernetes.io/control-plane"
-      operator: "Exists"
-      effect: "NoSchedule"
-    - key: "infra.limbosolutions.com/dedicated"
-      operator: "Exists"
-      effect: "NoSchedule"
-
-alloy:
-  mounts:
-    varlog: true  # Mounts /var/log from the host (persistent journal)
-    extra:
-      # requires host journal configuration storage = volatile
-      - name: run-log-journal
-        mountPath: /run/log/journal
-        readOnly: true
-      # required 
-      - name: etc-machine-id
-        mountPath: /etc/machine-id
-        readOnly: true
-      - name: rootfs
-        mountPath: /host
-        readOnly: true
-      - name: proc
-        mountPath: /host/proc
-        readOnly: true
-      - name: sys
-        mountPath: /host/sys
-        readOnly: true
-      - name: dev
-        mountPath: /host/dev
-        readOnly: true 
-  # https://grafana.com/docs/alloy/latest/collect/logs-in-kubernetes/
-  configMap:
-    content: |
-      logging {
-        level = "warn"
-      }
-      
-      // ============================================
-      // LOKI WRITE TARGET
-      // ============================================
-      loki.write "loki_srv" {
-        endpoint {
-          url = sys.env("LOKI_URL")
-        }
-      }
-
-      // ============================================
-      // HOST JOURNALD SOURCE
-      // ============================================
-
-      // Read journald logs from the host
-      loki.source.journal "journal" {
-        max_age   = "24h"
-        relabel_rules = discovery.relabel.host_journal.rules
-        forward_to    = [loki.process.host_journal.receiver]
-      }
-
-      // ============================================
-      // HOST JOURNALD RELABELING
-      // ============================================
-
-      // Convert journald metadata into Loki labels
-      discovery.relabel "host_journal" {
-        targets = []
-
-        // Systemd unit name
-        rule {
-          source_labels = ["__journal__systemd_unit"]
-          target_label  = "systemd_unit"
-        }
-
-        // Transport type (stdout, syslog, kernel, audit, etc.)
-        rule {
-          source_labels = ["__journal__transport"]
-          target_label  = "journal_transport"
-        }
-
-        // Priority (info, warning, error)
-        rule {
-          source_labels = ["__journal_priority_keyword"]
-          target_label  = "level"
-        }
-      }
-
-      // ============================================
-      // HOST JOURNALD PROCESSING
-      // ============================================
-
-      // Add static labels and forward journald logs to Loki
-      loki.process "host_journal" {
-        stage.static_labels {
-          values = {
-            cluster = sys.env("CLUSTER_NAME"),
-            host    = sys.env("HOSTNAME"),
-            zone    = sys.env("ZONE"),
-            job     = "journald",
-            service_name = "journald",
-          }
-        }
-
-        forward_to = [loki.write.loki_srv.receiver]
-      }
-
-
-
-
-      // ============================================
-      // Metrics: Prometheus connection config
-      // ============================================
-
-      prometheus.remote_write "metrics_service" {
-        endpoint {
-          url = sys.env("PROMETHEUS_URL")
-        }
-        
-        // global labels
-        external_labels = {
-          cluster     = sys.env("CLUSTER_NAME"),
-          zone        = sys.env("ZONE"),
-        }
-      }
-
-
-      // ============================================
-      // Metrics: Prometheus Unix Exporter
-      // ============================================
-
-      prometheus.exporter.unix "node_exporter" {
-        rootfs_path = "/host"
-        disable_collectors = ["ipvs", "btrfs", "infiniband", "xfs", "zfs"]
-        enable_collectors = [
-          "cpu",
-          "meminfo",
-          "vmstat",
-          "loadavg",
-          "filesystem",
-          "netdev",
-          "uname",
-        ]
-
-        filesystem {
-          mount_points_exclude = "^(/host|/)(etc/resolv.conf|etc/hosts|etc/hostname|etc/machine-id|dataDisks/nvme01-ephemeral/.+|proc|sys|run/containerd/.+|run/k3s/containerd/.+|var/lib/docker/.+|var/lib/kubelet/.+)($|/)"
-          fs_types_exclude     = "^(tmpfs|shm|autofs|binfmt_misc|bpf|cgroup2?|configfs|debugfs|devpts|devtmpfs|fusectl|hugetlbfs|iso9660|mqueue|nsfs|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|selinuxfs|squashfs|sysfs|tracefs|erofs)$"
-          mount_timeout        = "5s"
-        }
-
-        netclass {
-          ignored_devices = "^(veth.*|cali.*|[a-f0-9]{15})$"
-        }
-
-        netdev {
-          device_exclude = "^(veth.*|cali.*|[a-f0-9]{15})$"
-        }
-      }
-
-      prometheus.scrape "node_exporter" {
-        targets         = prometheus.exporter.unix.node_exporter.targets
-        scrape_interval = "30s"
-
-        forward_to = [prometheus.relabel.node_exporter.receiver]
-      }
-  
-      prometheus.relabel "node_exporter" {
-        forward_to = [prometheus.remote_write.metrics_service.receiver]
-
-        rule {
-          action       = "replace"
-          replacement  = sys.env("HOSTNAME")
-          target_label = "nodename"
-        }
-
-        rule {
-          action       = "replace"
-          replacement  = sys.env("HOSTNAME")
-          target_label = "node"
-        }
-      }
-
-
-
-  extraEnv:
-    - name: NODE_IP
-      valueFrom:
-        fieldRef:
-          fieldPath: status.hostIP
-    - name: CLUSTER_NAME
-      value: casa
-    - name: JOB
-      value: node-exporter
-    - name: CONTAINER
-      value: node-exporter
-    - name: NS
-      value: monitoring
-    - name: POD
-      value: alloy-node-scraper
-    - name: SERVICE
-      value: alloy-node-scraper
-    - name: ZONE
-      value: casa-vlan
-    - name: LOKI_URL
-      valueFrom:
-        secretKeyRef:
-          name: alloy-global
-          key: loki_url
-    - name: PROMETHEUS_URL
-      valueFrom:
-        secretKeyRef:
-          name: alloy-global
-          key: prometheus_url

services/monitoring/deploy/alloy/node-scraper/kustomization.yaml

@@ -1,11 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: monitoring
-resources:
-  - helm-release.yaml
-secretGenerator:
-  - name: alloy-node-scraper-helm-values
-    files:
-      - values.yaml=helm-values.yaml
-generatorOptions:
-  disableNameSuffixHash: true

services/monitoring/deploy/flux/flux-kustomization-prometheus.yaml

@@ -1,16 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: kube-state-metrics
-spec:
-  interval: 1m
-  sourceRef:
-    kind: GitRepository
-    name: casa
-    namespace: casa-limbosolutions-com
-  path: services/monitoring/deploy/prometheus
-  prune: true
-  decryption:
-    provider: sops
-    secretRef:
-      name: flux-sops-age

services/monitoring/deploy/prometheus/helm-release.yaml

@@ -1,15 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: kube-state-metrics
-spec:
-  releaseName: kube-state-metrics
-  interval: 1m
-  chart:
-    spec:
-      chart: kube-state-metrics
-      version: 8.x.x
-      sourceRef:
-        kind: HelmRepository
-        name: prometheus
-      interval: 40h

services/monitoring/deploy/prometheus/helm-repo.yaml

@@ -1,7 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: prometheus
-spec:
-  interval: 40h
-  url: https://prometheus-community.github.io/helm-charts

services/monitoring/deploy/prometheus/kustomization.yaml

@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: monitoring
-resources:
- - helm-repo.yaml 
- - helm-release.yaml