feat(flux): 分阶段接管 VictoriaMetrics Operator

clusters/homelab/README.md

@@ -47,5 +47,7 @@ sudo k3s kubectl -n flux-system get gitrepositories,kustomizations
 - cert-manager 已固定现有 `v1.21.0` 并完成分阶段 Flux HelmRelease 接管；
 - Envoy Gateway 已固定现有 `v1.5.6` 并完成分阶段 Flux HelmRelease 接管；
 - OpenEBS 已固定现有 `4.4.0` 并完成分阶段 Flux HelmRelease 接管；
+- 可观测性栈开始分阶段接管：VictoriaMetrics Operator 固定现有 chart `0.66.2`，
+  HelmRelease 暂停等待 CRD 与 workload 基线验证；
 - External Secrets Operator 已固定 chart `2.8.0` 并完成分阶段接管；
 - root Kustomization 与所有 brownfield 子 Kustomization 继续保持 `prune: false`。

clusters/homelab/apps/observability.yaml

@@ -0,0 +1,14 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: observability
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./platform/observability
+  prune: false
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  timeout: 3m
+  wait: false

clusters/homelab/kustomization.yaml

@@ -10,3 +10,4 @@ resources:
   - apps/gitea-actions.yaml
   - apps/http-echo.yaml
   - apps/openebs.yaml
+  - apps/observability.yaml

platform/observability/README.md

@@ -13,6 +13,17 @@ Jaeger API), Grafana (3 datasources healthy, VM dashboard loaded, Tailscale ingr
 `localpv-zfs-ceph`. Note the vmagent hot-reload RBAC fix (`metrics/reload-rbac.yaml`,
 see `metrics/README-reload.md`) and that VL/VT CRDs are served under `.../v1`.
 
+### Flux 接管状态
+
+可观测性栈使用一个 `observability` Flux Kustomization，按依赖顺序逐步加入 Operator、
+Metrics、Logs、Traces 和 Grafana，避免多个 reconciler 争夺共享 namespace、Helm source
+或 VictoriaMetrics CRD。brownfield 迁移期间保持 `prune: false`。
+
+第一阶段仅接管 VictoriaMetrics Operator：现有 chart `0.66.2` / app `v0.73.1`、Helm
+revision 2，保存 values 与 `operator/values.yaml` 一致。Git 中先登记固定版本且
+`suspend: true` 的 HelmRelease，不运行 Helm upgrade。确认 source Ready、operator Pod
+UID、CRD 及现有 VM/VL/VT CR 未变化后，再通过独立 PR 解除暂停。
+
 Still host-side (not yet done): deploy `docker-hosts/compose.yaml` on the Docker
 hosts and `logs/vlogs-ingress.yaml` to push their logs.
 

platform/observability/helmrepository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: vm
+  namespace: monitoring
+spec:
+  interval: 1h
+  url: https://victoriametrics.github.io/helm-charts/

platform/observability/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - helmrepository.yaml
+  - operator

platform/observability/operator/helmrelease.yaml

@@ -0,0 +1,35 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: vm-operator
+  namespace: monitoring
+spec:
+  # Operator 和 CRD 先只登记；解除暂停必须在独立 PR 中进行。
+  suspend: true
+  chart:
+    spec:
+      chart: victoria-metrics-operator
+      interval: 1h
+      sourceRef:
+        kind: HelmRepository
+        name: vm
+      version: 0.66.2
+  driftDetection:
+    mode: enabled
+  install:
+    crds: CreateReplace
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 5m
+  interval: 30m
+  releaseName: vm-operator
+  targetNamespace: monitoring
+  timeout: 10m
+  upgrade:
+    crds: CreateReplace
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 5m
+  valuesFrom:
+    - kind: ConfigMap
+      name: vm-operator-values

platform/observability/operator/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+generatorOptions:
+  disableNameSuffixHash: true
+  labels:
+    reconcile.fluxcd.io/watch: Enabled
+configMapGenerator:
+  - name: vm-operator-values
+    namespace: monitoring
+    files:
+      - values.yaml=values.yaml
+resources:
+  - helmrelease.yaml