Erich Blume
17023085cb
Note: the name of this branch was chosen before the scope widened to encompass the entire observability stack. Summary - Fix Grafana data source URLs (docker driver uses host.minikube.internal, not host.containers.internal) - Migrate Prometheus and Loki from indri to Kubernetes with Tailscale Ingresses - Expose CNPG PostgreSQL metrics via Tailscale and update dashboard to use cnpg_* metrics - Update Alloy to push metrics/logs to k8s endpoints (prometheus.tail8d86e.ts.net, loki.tail8d86e.ts.net) - Add ACL rule for port 9187 (CNPG metrics) - Delete obsolete ansible roles for prometheus and loki Changes - argocd/manifests/prometheus/ - New Prometheus StatefulSet with 20Gi PVC and Tailscale Ingress - argocd/manifests/loki/ - New Loki StatefulSet with 20Gi PVC and Tailscale Ingress - argocd/apps/prometheus.yaml, argocd/apps/loki.yaml - ArgoCD Applications - argocd/manifests/grafana/values.yaml - Data sources now use k8s internal DNS - argocd/manifests/databases/service-metrics-tailscale.yaml - CNPG metrics endpoint - argocd/manifests/grafana-config/dashboards/configmap-postgresql.yaml - Updated to cnpg_* metrics - ansible/roles/alloy/defaults/main.yml - Push to k8s Tailscale endpoints - pulumi/policy.hujson - ACL for port 9187 - Deleted ansible/roles/prometheus/ and ansible/roles/loki/ Deployment and Testing - Stop prometheus and loki on indri - Sync ArgoCD apps (apps, prometheus, loki, grafana) - Run mise run provision-indri -- --tags alloy - Verify Grafana dashboards show data 🤖 Generated with https://claude.ai/claude-code Reviewed-on: https://forge.tail8d86e.ts.net/eblume/blumeops/pulls/42
95 lines
2.7 KiB
YAML
95 lines
2.7 KiB
YAML
---
|
|
# Grafana Alloy installation and configuration
|
|
# See defaults/main.yml for build instructions
|
|
|
|
- name: Verify alloy binary exists
|
|
ansible.builtin.stat:
|
|
path: "{{ alloy_binary }}"
|
|
register: alloy_binary_stat
|
|
|
|
- name: Fail if alloy binary not found
|
|
ansible.builtin.fail:
|
|
msg: |
|
|
Alloy binary not found at {{ alloy_binary }}.
|
|
Please build from source first (see ansible/roles/alloy/defaults/main.yml)
|
|
when: not alloy_binary_stat.stat.exists
|
|
|
|
- name: Ensure alloy config directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ alloy_config_dir }}"
|
|
state: directory
|
|
mode: '0755'
|
|
|
|
- name: Ensure alloy data directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ alloy_data_dir }}"
|
|
state: directory
|
|
mode: '0755'
|
|
|
|
- name: Ensure textfile collector directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ alloy_textfile_dir }}"
|
|
state: directory
|
|
mode: '0755'
|
|
|
|
# === Fetch PostgreSQL password from 1Password ===
|
|
# Skipped when running full playbook (pre_tasks sets it)
|
|
# but runs when using --tags alloy
|
|
|
|
- name: Fetch PostgreSQL metrics password from 1Password
|
|
ansible.builtin.command:
|
|
cmd: >-
|
|
op --vault {{ alloy_op_vault }} item get {{ alloy_op_postgres_item }}
|
|
--fields {{ alloy_op_postgres_field }} --reveal
|
|
delegate_to: localhost
|
|
register: alloy_postgres_password_result
|
|
changed_when: false
|
|
no_log: true
|
|
when:
|
|
- alloy_collect_postgres | default(false)
|
|
- alloy_postgres_password is not defined
|
|
|
|
- name: Set PostgreSQL password fact
|
|
ansible.builtin.set_fact:
|
|
alloy_postgres_password: "{{ alloy_postgres_password_result.stdout }}"
|
|
no_log: true
|
|
when:
|
|
- alloy_collect_postgres | default(false)
|
|
- alloy_postgres_password is not defined
|
|
|
|
# === Deploy configuration ===
|
|
|
|
- name: Deploy PostgreSQL custom queries config
|
|
ansible.builtin.template:
|
|
src: postgres_queries.yaml.j2
|
|
dest: "{{ alloy_config_dir }}/postgres_queries.yaml"
|
|
mode: '0600'
|
|
notify: Restart alloy
|
|
when: alloy_collect_postgres | default(false)
|
|
|
|
- name: Deploy alloy configuration
|
|
ansible.builtin.template:
|
|
src: config.alloy.j2
|
|
dest: "{{ alloy_config_dir }}/config.alloy"
|
|
mode: '0600'
|
|
notify: Restart alloy
|
|
no_log: true
|
|
|
|
- name: Deploy alloy LaunchAgent plist
|
|
ansible.builtin.template:
|
|
src: alloy.plist.j2
|
|
dest: ~/Library/LaunchAgents/mcquack.eblume.alloy.plist
|
|
mode: '0644'
|
|
notify: Restart alloy
|
|
|
|
- name: Check if alloy LaunchAgent is loaded
|
|
ansible.builtin.command: launchctl list mcquack.eblume.alloy
|
|
register: alloy_launchctl_check
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Load alloy LaunchAgent if not loaded
|
|
ansible.builtin.command: launchctl load ~/Library/LaunchAgents/mcquack.eblume.alloy.plist
|
|
when: alloy_launchctl_check.rc != 0
|
|
changed_when: true
|
|
failed_when: false
|