# Prometheus ConfigMap — scrape config for EDDI
apiVersion: v1
kind: ConfigMap
metadata:
  name: prometheus-config
  labels:
    app.kubernetes.io/name: prometheus
    app.kubernetes.io/component: monitoring
    app.kubernetes.io/part-of: eddi
data:
  prometheus.yml: |
    global:
      scrape_interval: 15s
      evaluation_interval: 15s

    scrape_configs:
      - job_name: 'eddi'
        metrics_path: '/q/metrics'
        kubernetes_sd_configs:
          - role: pod
            namespaces:
              names:
                - eddi
        relabel_configs:
          # Keep only pods with the EDDI label
          - source_labels: [__meta_kubernetes_pod_label_app_kubernetes_io_name]
            action: keep
            regex: eddi
          # Use pod IP + Prometheus port annotation to build the scrape address
          - source_labels: [__meta_kubernetes_pod_ip, __meta_kubernetes_pod_annotation_prometheus_io_port]
            action: replace
            target_label: __address__
            separator: ':'
            regex: (.+);(.+)
            replacement: $1:$2
          # Use the Prometheus path annotation
          - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path]
            action: replace
            target_label: __metrics_path__
            regex: (.+)
          # Only scrape pods that opt in
          - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
            action: keep
            regex: "true"
---
# Prometheus ServiceAccount — required for pod discovery via kubernetes_sd_configs
apiVersion: v1
kind: ServiceAccount
metadata:
  name: prometheus
  labels:
    app.kubernetes.io/name: prometheus
    app.kubernetes.io/component: monitoring
    app.kubernetes.io/part-of: eddi
---
# RBAC — ClusterRole for pod/service/endpoint read access
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: eddi-prometheus
  labels:
    app.kubernetes.io/name: prometheus
    app.kubernetes.io/part-of: eddi
rules:
  - apiGroups: [""]
    resources: ["pods", "services", "endpoints"]
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: eddi-prometheus
  labels:
    app.kubernetes.io/name: prometheus
    app.kubernetes.io/part-of: eddi
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: eddi-prometheus
subjects:
  - kind: ServiceAccount
    name: prometheus
    namespace: eddi
---
# Prometheus Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: prometheus
  labels:
    app.kubernetes.io/name: prometheus
    app.kubernetes.io/component: monitoring
    app.kubernetes.io/part-of: eddi
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: prometheus
      app.kubernetes.io/component: monitoring
  template:
    metadata:
      labels:
        app.kubernetes.io/name: prometheus
        app.kubernetes.io/component: monitoring
        app.kubernetes.io/part-of: eddi
    spec:
      serviceAccountName: prometheus
      containers:
        - name: prometheus
          image: prom/prometheus:v2.53.0
          args:
            - "--config.file=/etc/prometheus/prometheus.yml"
            - "--storage.tsdb.retention.time=30d"
          ports:
            - containerPort: 9090
              name: http
          volumeMounts:
            - name: config
              mountPath: /etc/prometheus
            - name: data
              mountPath: /prometheus
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
            limits:
              cpu: 500m
              memory: 512Mi
      volumes:
        - name: config
          configMap:
            name: prometheus-config
        - name: data
          emptyDir: {}
---
# Prometheus Service
apiVersion: v1
kind: Service
metadata:
  name: prometheus
  labels:
    app.kubernetes.io/name: prometheus
    app.kubernetes.io/component: monitoring
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: prometheus
    app.kubernetes.io/component: monitoring
  ports:
    - name: http
      port: 9090
      targetPort: http
---
# Grafana Deployment
# Note: Uses emptyDir for storage — dashboards and data are not persistent.
# For production, use a PVC or provision dashboards via ConfigMaps.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: grafana
  labels:
    app.kubernetes.io/name: grafana
    app.kubernetes.io/component: monitoring
    app.kubernetes.io/part-of: eddi
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: grafana
      app.kubernetes.io/component: monitoring
  template:
    metadata:
      labels:
        app.kubernetes.io/name: grafana
        app.kubernetes.io/component: monitoring
        app.kubernetes.io/part-of: eddi
    spec:
      containers:
        - name: grafana
          image: grafana/grafana:11.1.0
          ports:
            - containerPort: 3000
              name: http
          env:
            - name: GF_SECURITY_ADMIN_USER
              value: "admin"
            - name: GF_SECURITY_ADMIN_PASSWORD
              value: "admin"
          volumeMounts:
            - name: grafana-data
              mountPath: /var/lib/grafana
          resources:
            requests:
              cpu: 50m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 512Mi
      volumes:
        - name: grafana-data
          emptyDir: {}
---
# Grafana Service
apiVersion: v1
kind: Service
metadata:
  name: grafana
  labels:
    app.kubernetes.io/name: grafana
    app.kubernetes.io/component: monitoring
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: grafana
    app.kubernetes.io/component: monitoring
  ports:
    - name: http
      port: 3000
      targetPort: http
