apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: kube-prometheus-stack
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://prometheus-community.github.io/helm-charts
    chart: kube-prometheus-stack
    targetRevision: ">=60.0.0, <70.0.0"
    helm:
      values: |
        grafana:
          admin:
            existingSecret: grafana-admin-secret
            passwordKey: admin-password
          persistence:
            enabled: true
            size: 5Gi
          sidecar:
            datasources:
              defaultDatasourceEnabled: false
          initChownData:
            enabled: false
          ingress:
            enabled: true
            ingressClassName: traefik
            hosts:
              - grafana.neuralplatform.ai
            tls:
              - secretName: grafana-tls
                hosts:
                  - grafana.neuralplatform.ai
            annotations:
              traefik.ingress.kubernetes.io/router.entrypoints: websecure
              cert-manager.io/cluster-issuer: letsencrypt-prod
        prometheus:
          prometheusSpec:
            # Discover ServiceMonitors and PrometheusRules from ALL namespaces.
            # Without this, Prometheus only sees resources in the monitoring namespace.
            serviceMonitorSelectorNilUsesHelmValues: false
            serviceMonitorNamespaceSelector: {}
            serviceMonitorSelector: {}
            ruleNamespaceSelector: {}
            podMonitorNamespaceSelector: {}
            storageSpec:
              volumeClaimTemplate:
                spec:
                  resources:
                    requests:
                      storage: 20Gi
        kubeEtcd:
          enabled: false
        kubeControllerManager:
          enabled: false
        kubeScheduler:
          enabled: false
        kubeProxy:
          enabled: false
        alertmanager:
          config:
            global:
              resolve_timeout: 5m
            inhibit_rules:
              - source_matchers: [severity="critical"]
                target_matchers: [severity=~"warning|info"]
                equal: [namespace, alertname]
              - source_matchers: [severity="warning"]
                target_matchers: [severity="info"]
                equal: [namespace, alertname]
            receivers:
              - name: "null"
              - name: slack-alerts
                slack_configs:
                  - channel: "#infrastructure-alerts"
                    api_url: "https://slack.com/api/chat.postMessage"
                    http_config:
                      authorization:
                        type: Bearer
                        credentials_file: /etc/alertmanager/secrets/slack-bot-token/bot_token
                    send_resolved: true
                    title: '[{{ .Status | toUpper }}{{ if eq .Status "firing" }}:{{ .Alerts.Firing | len }}{{ end }}] {{ .CommonLabels.alertname }} ({{ .CommonLabels.namespace }})'
                    text: |
                      {{ range .Alerts }}
                      *{{ if .Annotations.summary }}{{ .Annotations.summary }}{{ else }}{{ .Labels.alertname }}{{ end }}*{{ if .Labels.severity }} · {{ .Labels.severity }}{{ end }}
                      {{ if .Annotations.description }}{{ .Annotations.description }}{{ end }}
                      {{ end }}
                    footer: "Legion · neuralplatform.ai"
            route:
              group_by: [namespace, alertname]
              group_wait: 30s
              group_interval: 5m
              repeat_interval: 4h
              receiver: slack-alerts
              routes:
                - matchers: [alertname="Watchdog"]
                  receiver: "null"
                - matchers: [severity="info"]
                  receiver: "null"
          alertmanagerSpec:
            secrets:
              - slack-bot-token
  destination:
    server: https://kubernetes.default.svc
    namespace: monitoring
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
      - ServerSideApply=true