Add platform infrastructure configuration

2026-08-28 17:35:41 +09:00
parent fa76531e5b
commit 16c337bcc9
302 changed files with 83259 additions and 1 deletions
@@ -0,0 +1,11 @@
+# node-exporter
+
+The standalone node-exporter runs in `observability-agent` with the embedded
+kube-prometheus-stack copy and kube-rbac-proxy disabled. It mounts only
+`/proc`, `/sys`, and `/` from the node, all read-only, and exposes an internal
+ClusterIP metrics Service on port `9100`.
+
+Host network, PID, and IPC namespaces remain disabled by the platform security
+contract. Consequently, network-namespace metrics are treated as a known
+single-node visibility limitation rather than authoritative host-network data.
+
@@ -0,0 +1,23 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: observability-agent
+
+helmGlobals:
+  chartHome: .helm/charts
+
+helmCharts:
+  - name: prometheus-node-exporter
+    repo: https://prometheus-community.github.io/helm-charts
+    version: 4.56.1
+    releaseName: node-exporter
+    namespace: observability-agent
+    valuesFile: values/home.yaml
+    includeCRDs: false
+    skipTests: true
+
+images:
+  - name: quay.io/prometheus/node-exporter
+    newName: quay.io/prometheus/node-exporter
+    digest: sha256:da83fae85603c4e47e6c68369a7d746e2dda683dc35ea2e234b4f171e0d92798
+
@@ -0,0 +1,78 @@
+fullnameOverride: node-exporter
+namespaceOverride: observability-agent
+
+image:
+  registry: quay.io
+  repository: prometheus/node-exporter
+  tag: v1.12.1
+  pullPolicy: IfNotPresent
+
+kubeRBACProxy:
+  enabled: false
+
+service:
+  enabled: true
+  type: ClusterIP
+  port: 9100
+  targetPort: 9100
+  portName: metrics
+  listenOnAllInterfaces: true
+
+prometheus:
+  monitor:
+    enabled: true
+    additionalLabels:
+      observability.hyeonworks.com/instance: home
+    interval: 30s
+  podMonitor:
+    enabled: false
+
+resources:
+  requests:
+    cpu: 100m
+    memory: 128Mi
+  limits:
+    cpu: 250m
+    memory: 256Mi
+
+serviceAccount:
+  create: true
+  automountServiceAccountToken: false
+
+rbac:
+  create: true
+
+securityContext:
+  fsGroup: 65534
+  runAsGroup: 65534
+  runAsNonRoot: true
+  runAsUser: 65534
+  seccompProfile:
+    type: RuntimeDefault
+
+containerSecurityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+  privileged: false
+  readOnlyRootFilesystem: true
+
+hostNetwork: false
+hostPID: false
+hostIPC: false
+
+hostRootFsMount:
+  enabled: true
+  mountPropagation: None
+hostProcFsMount:
+  mountPropagation: None
+hostSysFsMount:
+  mountPropagation: None
+
+nodeSelector:
+  kubernetes.io/os: linux
+
+tolerations:
+  - effect: NoSchedule
+    operator: Exists