monitoring: add overlay to chimera cluster

global: fluxcd cluster concept

.gitignore

@@ -0,0 +1,5 @@
+.tests
+.secrets
+**/.env
+/.obsidian
+**.dec.**

cluster/chimera/README.md

@@ -0,0 +1,3 @@
+# Chimera - cluster
+
+It is not this repo/kustomization’s responsibility to deploy the alloy - Age private key — that responsibility belongs to the Chimera repository.

cluster/chimera/alloy-sync.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: alloy
+spec:
+  interval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: chimera
+    namespace: flux-system
+  path: ./monitoring/overlays/chimera
+  prune: true
+  decryption:
+    provider: sops
+    secretRef:
+      name: flux-sops-age

cluster/chimera/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - node-scraper
+  - alloy-sync.yaml  
+generatorOptions:
+  disableNameSuffixHash: true

cluster/shared-reps/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - repos.yaml   
+generatorOptions:
+  disableNameSuffixHash: true

cluster/shared-reps/repos.yaml

@@ -0,0 +1,9 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: myinfra-kubernetes-shared
+spec:
+  interval: 1m0s
+  url: https://git.limbosolutions.com/myLimbo/myinfra.kubernetes.shared.git
+  ref:
+    branch: main

monitoring/overlays/chimera/.sops.yaml

@@ -0,0 +1,11 @@
+creation_rules:
+
+ # encrypt secrets file
+  - path_regex: .*.yaml
+    encrypted_regex: ^(data|stringData)$
+    age:
+      - age1fvpvtw42l3k5nysuffnmlc35gludra7ytmqy4g8t7qfg65ktt9hsha9tw8
+      
+
+
+ 

monitoring/overlays/chimera/README.md

@@ -0,0 +1,7 @@
+# Chimera cluster - Readme
+
+**Encrypt secrets:**
+
+``` bash
+sops -e alloy-global/secrets.dec.yaml > alloy-global/secrets.yaml
+```

monitoring/overlays/chimera/alloy-global/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - secrets.yaml
+generatorOptions:
+  disableNameSuffixHash: true

monitoring/overlays/chimera/alloy-global/secrets.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: alloy-global
+stringData:
+    loki_url: ENC[AES256_GCM,data:EhfWTVwbPGim27qeHVlUi2DZjMDvSMhhJRlsEQQzj3PytYhyDBlq8YGaH6DpsgBaw/Z3tUfBgqhREl0=,iv:+Xj9BhaRWMdQVGcdEO6n6NW/lgtZKO/xWZGhVt5vOhQ=,tag:8xH2W6hxrFx8VS4zwN6RXQ==,type:str]
+    prometheus_url: ENC[AES256_GCM,data:xT+qDNiVRZsoAgphIY151mvHjbB1Q8jFSLYxbSTzWxMOCYqOJaLdoq0tTS5HO5gyfcCMfHqtJMGp2r1zfg==,iv:RZRJkxX6giA0YeO0sHYl3EeQOk/6/c3ngfdGDwOwipg=,tag:PTrQY1pWuqqLMADdXKL9Yg==,type:str]
+    zone: ENC[AES256_GCM,data:HbMnWtuqs6s=,iv:4/Y87kzDi5/vSICi12KM9fQrctKGpa7EsVlFWNNHqvM=,tag:iia7qrV+PIOpodN0Ep3JoQ==,type:str]
+    cluster_name: ENC[AES256_GCM,data:OKQ3BqGGig==,iv:yStZxRbp18K0KthOPrh1bm6gQnRZeWTDVZXU8z9G2YU=,tag:O/SsPbKGTDyE+BaeV66bAg==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4amU4VyttSWhNMkNnNTNp
+            SjBFcWNkcXd1NE5UcElzWXhzZmZ1Rm45eXg0CnBIMW43NzJhYzk5YXJ0TFJQRlRK
+            WnRlMmsvSndqWTBpSWIrRW9ObWdDV0UKLS0tIHFTc2hUMG1JVjlPNWlIbDVSMy9J
+            VEMwanlCM3kyRkFFQU1lTkxpRGQ3U2cKUZ6MB0rG7QqQgcdA8Ti9eriRnVuRvqIB
+            t13AZyNcMCqkbVjKb6nv7GnHiLpeVb8j7MK/FqaVujStjJJq2krSHQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1fvpvtw42l3k5nysuffnmlc35gludra7ytmqy4g8t7qfg65ktt9hsha9tw8
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-09-13T12:17:28Z"
+    mac: ENC[AES256_GCM,data:BKJ/8daxky2wRrBTL5e5nKHoLreb7bAQsvm4JK8Va/nPtSNHdalYL7/fDBtzkJ2jsT+8FY98UiRYV9qDE3R9eyUyD2rQv2R3S6mQQljyEKeqOnOf897fNdPlUcYSp9owO77aajKzlcwI4nqbNuDp9uZnLmnKuMWIX49+KvzAQRA=,iv:X5uv18PXn1pZEh7Rp0rgOb9n5rod4Gm5WAWyV2J6jX0=,tag:Cg7vMNe4RFzxRZn2MesKBw==,type:str]
+    version: 3.13.1

monitoring/overlays/chimera/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: monitoring
+resources:
+  - alloy-global
+  - ../../base/alloy/node-scraper
+generatorOptions:
+  disableNameSuffixHash: true