infra-prod/deploy/prometheus/deploy.jsonnet

// Import the kube-prometheus library
local kp = (import 'kube-prometheus/main.libsonnet') + {

  // Override common values (namespace)
  values+:: {
    common+: { namespace: 'monitoring' },
  },

  // Disable the built-in Grafana component
  grafana+:: {},

  // Prometheus customizations: external URL and persistent storage
  prometheus+:: {
    prometheus+: {
      spec+: {
        externalUrl: 'https://metrics.prod.panic.haus',
        retention: '30d',
        storage: {
          volumeClaimTemplate: {
            spec: {
              accessModes: ['ReadWriteOnce'],
              resources: { requests: { storage: '20Gi' } },
              storageClassName: 'longhorn',
            },
          },
        },
      },
    },
  },

  // Alertmanager customizations: external URL
  alertmanager+:: {
    alertmanager+: {
      spec+: {
        externalUrl: 'https://alerts.prod.panic.haus',
      },
    },
  },

  // Define a helper function for creating Ingress objects
  local ingress(name, namespace, rules) = {
    apiVersion: 'networking.k8s.io/v1',
    kind: 'Ingress',
    metadata: {
      name: name,
      namespace: namespace,
      annotations: {},
    },
    spec: {
      ingressClassName: 'nginx',
      rules: rules,
      tls: [],
    },
  },

  // Ingress resources for Prometheus and Alertmanager UIs
  ingress+:: {
    'alertmanager-main': ingress(
        'alertmanager-main',
        $.values.common.namespace,
        [{
          host: 'alerts.prod.panic.haus',
          http: {
            paths: [{
              path: '/',
              pathType: 'Prefix',
              backend: {
                service: { name: 'alertmanager-main', port: { name: 'web' } },
              },
            }],
          },
        }]
      ) + {
        metadata+: {
          annotations: { 'cert-manager.io/cluster-issuer': 'letsencrypt-prod' },
        },
        spec+: {
          tls: [{
            hosts: ['alerts.prod.panic.haus'],
            secretName: 'alerts-tls',
          }],
        },
      },

    'prometheus-k8s': ingress(
        'prometheus-k8s',
        $.values.common.namespace,
        [{
          host: 'metrics.prod.panic.haus',
          http: {
            paths: [{
              path: '/',
              pathType: 'Prefix',
              backend: {
                service: { name: 'prometheus-k8s', port: { name: 'web' } },
              },
            }],
          },
        }]
      ) + {
        metadata+: {
          annotations: { 'cert-manager.io/cluster-issuer': 'letsencrypt-prod' },
        },
        spec+: {
          tls: [{
            hosts: ['metrics.prod.panic.haus'],
            secretName: 'monitoring-tls',
          }],
        },
      },
  },
};

// Assemble all manifests (kube-prometheus stack components)
{ 'setup/0namespace-namespace': kp.kubePrometheus.namespace } +
{ ['setup/prometheus-operator-' + name]: kp.prometheusOperator[name] 
    for name in std.filter(function(name) name != 'serviceMonitor' && name != 'prometheusRule',
                            std.objectFields(kp.prometheusOperator)) } +
{ 'prometheus-operator-serviceMonitor': kp.prometheusOperator.serviceMonitor } +
{ 'prometheus-operator-prometheusRule': kp.prometheusOperator.prometheusRule } +
{ 'kube-prometheus-prometheusRule': kp.kubePrometheus.prometheusRule } +
{ ['alertmanager-' + name]: kp.alertmanager[name] for name in std.objectFields(kp.alertmanager) } +
{ ['blackbox-exporter-' + name]: kp.blackboxExporter[name] for name in std.objectFields(kp.blackboxExporter) } +
// { ['grafana-' + name]: kp.grafana[name] for name in std.objectFields(kp.grafana) } +  // Grafana disabled
{ ['kube-state-metrics-' + name]: kp.kubeStateMetrics[name] for name in std.objectFields(kp.kubeStateMetrics) } +
{ ['kubernetes-' + name]: kp.kubernetesControlPlane[name] for name in std.objectFields(kp.kubernetesControlPlane) } +
{ ['node-exporter-' + name]: kp.nodeExporter[name] for name in std.objectFields(kp.nodeExporter) } +
{ ['prometheus-' + name]: kp.prometheus[name] for name in std.objectFields(kp.prometheus) } +
{ ['prometheus-adapter-' + name]: kp.prometheusAdapter[name] for name in std.objectFields(kp.prometheusAdapter) } +
{ [name + '-ingress']: kp.ingress[name] for name in std.objectFields(kp.ingress) }

/*
  Add a ServiceMonitor for Prometheus self-scrape.
  The relabeling below forces the job label to be "prometheus", so that querying with:
      up{job="prometheus"}
  will return Prometheus's own metrics.

  NOTE: Adjust the matchLabels selector if your Prometheus service has different labels.
*/

{ 'prometheus-self-monitor': {
    apiVersion: 'monitoring.coreos.com/v1',
    kind: 'ServiceMonitor',
    metadata: {
      name: 'prometheus-self-monitor',
      namespace: kp.values.common.namespace,
      labels: {
        release: 'prometheus',
      },
    },
    spec: {
      selector: {
        matchLabels: {
          // This selector should match labels on the Prometheus service.
          // Here we assume the Prometheus service is labeled with:
          //    prometheus: "prometheus-k8s"
          prometheus: 'prometheus-k8s',
        },
      },
      endpoints: [{
        port: 'web',      // Must match the name of the port exposed by the Prometheus service
        path: '/metrics',
        scheme: 'http',   // Change to "https" if your Prometheus endpoint requires it
        relabelings: [{
          targetLabel: 'job',
          replacement: 'prometheus',
        }],
      }],
    },
  },
}