Add platform infrastructure configuration

2026-08-28 17:35:41 +09:00
parent fa76531e5b
commit 16c337bcc9
302 changed files with 83259 additions and 1 deletions
@@ -0,0 +1,24 @@
+# Grafana
+
+Private Grafana for the home observability stack. The pinned Grafana chart is
+rendered as the independent `grafana` release in `observability`; the
+kube-prometheus-stack embedded Grafana remains disabled.
+
+The workload consumes, but never renders, these existing Secret contracts:
+
+- `grafana-admin`: `admin-user`, `admin-password`
+- `grafana-keycloak-oidc`: `client-id`, `client-secret`
+
+The `grafana` PVC is fixed to `observability-grafana-local-pv` (2Gi, Retain).
+Host Nginx terminates the exact-SAN certificate and forwards plain HTTP through
+Traefik; the Kubernetes Ingress therefore contains no TLS material.
+
+The Pod does not automount a service-account token. A 3600-second projected
+token, CA, and namespace are mounted only into `grafana-sc-dashboard`, whose
+namespaced Role can read ConfigMaps but not Secrets. Dashboard ConfigMaps must
+carry `grafana_dashboard: "1"` in `observability`.
+
+Provisioned datasource UIDs are `prometheus`, `loki`, and `tempo`. Tempo service
+map configuration is present for future use, but the metrics-generator and
+Prometheus remote-write path are intentionally not enabled, so service-graph
+availability is not an initial acceptance condition.