From 6b248780a4069d6b7717173f0aab20bb56d7e236 Mon Sep 17 00:00:00 2001
From: James Allenby <JamesAllenby@protonmail.com>
Date: Wed, 1 Jul 2026 20:09:32 +0100
Subject: [PATCH] feat: add metrics-server and prometheus apps, defer authentik
 (needs secret management)

---
 apps/metrics-server.yaml | 22 +++++++++++++++
 apps/prometheus.yaml     | 60 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 82 insertions(+)
 create mode 100644 apps/metrics-server.yaml
 create mode 100644 apps/prometheus.yaml

diff --git a/apps/metrics-server.yaml b/apps/metrics-server.yaml
new file mode 100644
index 0000000..db7dafd
--- /dev/null
+++ b/apps/metrics-server.yaml
@@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: metrics-server
+  namespace: argo-cd
+spec:
+  project: default
+  source:
+    repoURL: https://kubernetes-sigs.github.io/metrics-server
+    chart: metrics-server
+    targetRevision: 3.13.1
+    helm:
+      valuesObject:
+        args:
+          - --kubelet-insecure-tls
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: kube-system
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
diff --git a/apps/prometheus.yaml b/apps/prometheus.yaml
new file mode 100644
index 0000000..cf8dc3b
--- /dev/null
+++ b/apps/prometheus.yaml
@@ -0,0 +1,60 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: prometheus
+  namespace: argo-cd
+spec:
+  project: default
+  source:
+    repoURL: ghcr.io/prometheus-community/charts
+    chart: kube-prometheus-stack
+    targetRevision: 86.3.2
+    helm:
+      valuesObject:
+        grafana:
+          enabled: true
+          adminPassword: password
+          envFromSecrets:
+            - name: grafana-oidc-secret
+          grafana.ini:
+            server:
+              root_url: https://grafana.solidish.dev
+            auth.generic_oauth:
+              enabled: true
+              name: Authentik
+              client_id: $__env{GRAFANA_OIDC_CLIENT_ID}
+              client_secret: $__env{GRAFANA_OIDC_CLIENT_SECRET}
+              scopes: openid profile email
+              auth_url: https://auth.solidish.dev/application/o/authorize/
+              token_url: https://auth.solidish.dev/application/o/token/
+              api_url: https://auth.solidish.dev/application/o/userinfo/
+              role_attribute_path: contains(groups, 'admin') && 'Admin' || 'Viewer'
+              allow_assign_grafana_admin: true
+        alertmanager:
+          enabled: false
+        prometheus:
+          prometheusSpec:
+            retention: 30d
+            storageSpec:
+              volumeClaimTemplate:
+                spec:
+                  accessModes: ["ReadWriteOnce"]
+                  resources:
+                    requests:
+                      storage: 10Gi
+            resources:
+              requests:
+                cpu: 100m
+                memory: 512Mi
+              limits:
+                memory: 2Gi
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: monitoring
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true