feat(flux): 统一接管剩余可观测性栈

clusters/homelab/README.md

@@ -48,6 +48,6 @@ sudo k3s kubectl -n flux-system get gitrepositories,kustomizations
 - Envoy Gateway 已固定现有 `v1.5.6` 并完成分阶段 Flux HelmRelease 接管；
 - OpenEBS 已固定现有 `4.4.0` 并完成分阶段 Flux HelmRelease 接管；
 - VictoriaMetrics Operator 已固定现有 chart `0.66.2` 并完成分阶段 Flux HelmRelease
-  接管；Metrics、Logs、Traces 与 Grafana 仍待逐项接管；
+  接管；其余 Metrics、Logs、Traces 与 Grafana 已统一进入暂停 Helm release 的阶段一接管；
 - External Secrets Operator 已固定 chart `2.8.0` 并完成分阶段接管；
 - root Kustomization 与所有 brownfield 子 Kustomization 继续保持 `prune: false`。

platform/observability/README.md

@@ -22,7 +22,17 @@ Metrics、Logs、Traces 和 Grafana，避免多个 reconciler 争夺共享 names
 VictoriaMetrics Operator 已固定 chart `0.66.2` / app `v0.73.1` 完成分阶段 Flux
 HelmRelease 接管，保存 values 与 `operator/values.yaml` 一致。阶段一确认 Helm revision
 保持为 2、Operator Pod UID 未变、24 个 CRD 及 6 个核心 VM/VL/VT CR 未变化；随后
-通过独立 PR 解除暂停。Metrics、Logs、Traces 与 Grafana 仍需逐项接管。
+通过独立 PR 解除暂停。
+
+其余已部署资源统一进入第二批接管：Metrics CR、rules、scrapes、node-exporter，Logs 的
+VLSingle 与固定 `0.3.6` 的 Collector，以及 Traces 的 VTSingle、OTel Collector，最后是
+固定 `10.5.15` 的 Grafana 与 dashboard ConfigMap。Collector 和 Grafana 先以
+`suspend: true` 登记，静态资源以 server-side dry-run 确认无 spec 差异后由 Flux 接管。
+
+以下内容明确不属于本批接管：尚未部署的 kube-state-metrics、`vlogs-ingress.yaml`，以及
+仅作 standalone chart 参考的 `traces-values.yaml`。`grafana/oidc-secret.yaml` 是不含真实
+值的占位模板；live `grafana-oidc` Secret 继续只被 HelmRelease 引用，尚未由 OpenBao/ESO
+纳管。
 
 Still host-side (not yet done): deploy `docker-hosts/compose.yaml` on the Docker
 hosts and `logs/vlogs-ingress.yaml` to push their logs.

platform/observability/grafana-helmrepository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: grafana
+  namespace: monitoring
+spec:
+  interval: 1h
+  url: https://grafana.github.io/helm-charts

platform/observability/grafana/helmrelease.yaml

@@ -0,0 +1,32 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: grafana
+  namespace: monitoring
+spec:
+  suspend: true
+  chart:
+    spec:
+      chart: grafana
+      interval: 1h
+      sourceRef:
+        kind: HelmRepository
+        name: grafana
+      version: 10.5.15
+  driftDetection:
+    mode: enabled
+  install:
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 5m
+  interval: 30m
+  releaseName: grafana
+  targetNamespace: monitoring
+  timeout: 10m
+  upgrade:
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 5m
+  valuesFrom:
+    - kind: ConfigMap
+      name: grafana-values

platform/observability/grafana/kustomization.yaml

@@ -0,0 +1,21 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+generatorOptions:
+  disableNameSuffixHash: true
+configMapGenerator:
+  - name: grafana-values
+    namespace: monitoring
+    files:
+      - values.yaml=values.yaml
+    options:
+      labels:
+        reconcile.fluxcd.io/watch: Enabled
+  - name: grafana-dashboard-victoriametrics
+    namespace: monitoring
+    files:
+      - victoriametrics.json=dashboards/victoriametrics.json
+    options:
+      labels:
+        grafana_dashboard: "1"
+resources:
+  - helmrelease.yaml

platform/observability/kustomization.yaml

@@ -3,4 +3,9 @@ kind: Kustomization
 resources:
   - namespace.yaml
   - helmrepository.yaml
+  - grafana-helmrepository.yaml
   - operator
+  - metrics
+  - logs
+  - traces
+  - grafana

platform/observability/logs/helmrelease.yaml

@@ -0,0 +1,32 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: victoria-logs-collector
+  namespace: monitoring
+spec:
+  suspend: true
+  chart:
+    spec:
+      chart: victoria-logs-collector
+      interval: 1h
+      sourceRef:
+        kind: HelmRepository
+        name: vm
+      version: 0.3.6
+  driftDetection:
+    mode: enabled
+  install:
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 5m
+  interval: 30m
+  releaseName: victoria-logs-collector
+  targetNamespace: monitoring
+  timeout: 10m
+  upgrade:
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 5m
+  valuesFrom:
+    - kind: ConfigMap
+      name: victoria-logs-collector-values

platform/observability/logs/kustomization.yaml

@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+generatorOptions:
+  disableNameSuffixHash: true
+  labels:
+    reconcile.fluxcd.io/watch: Enabled
+configMapGenerator:
+  - name: victoria-logs-collector-values
+    namespace: monitoring
+    files:
+      - values.yaml=collector-values.yaml
+resources:
+  - vlsingle.yaml
+  - helmrelease.yaml

platform/observability/metrics/kustomization.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - vmsingle.yaml
+  - vmagent.yaml
+  - vmalert.yaml
+  - vmalertmanager.yaml
+  - reload-rbac.yaml
+  - rules/vm-health.yaml
+  - rules/vmagent.yaml
+  - rules/vmalert.yaml
+  - rules/vmsingle.yaml
+  - scrapes/blocky.yaml
+  - scrapes/docker-hosts.yaml
+  - scrapes/kubelet.yaml
+  - exporters/node-exporter.yaml

platform/observability/traces/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - vtsingle.yaml
+  - otel-collector.yaml