platform/nats/README.md

@@ -13,8 +13,6 @@
   不额外维护易漂移的源 IP 白名单。
 - TLS 证书由 `bao-acme` 签发。PVE 节点已信任内部 CA。
 - `SYS` Account 用于管理；`CI` Account 启用 JetStream，存储上限 1 GiB。
-- Prometheus exporter 已启用，但不创建 `PodMonitor`：集群使用 VictoriaMetrics
-  Operator CRD，后续以 `VMServiceScrape` 接入。
 
 首期使用静态用户，密码只存在 OpenBao `kv/k8s/nats`：
 

platform/nats/values.yaml

@@ -66,9 +66,7 @@ natsBox:
 promExporter:
   enabled: true
   podMonitor:
-    # This cluster uses VictoriaMetrics Operator CRDs, not Prometheus Operator's
-    # PodMonitor. Add a VMServiceScrape separately when NATS metrics are wired in.
-    enabled: false
+    enabled: true
 
 service:
   merge:

platform/observability/README.md

@@ -56,8 +56,10 @@ hosts and `logs/vlogs-ingress.yaml` to push their logs.
 | Manage   | **victoria-metrics-operator** | VMSingle/VMAgent/VMAlert/VMAlertmanager/VMRule **and** VLSingle as CRDs |
 | Expose   | **Tailscale ingress** (private) + **Authelia OIDC** | admin tool: private + SSO |
 
-Grafana's Prometheus-operator converter is on, so any chart shipping a
-`ServiceMonitor`/`PodMonitor`/`PrometheusRule` is scraped automatically.
+VictoriaMetrics Operator 的 Prometheus converter 已启用；官方
+`prometheus-operator-crds` chart 由 `operator/` 一并管理。因此应用 chart 可以原生
+声明 `ServiceMonitor`、`PodMonitor` 或 `PrometheusRule`，再由 converter 转换为对应
+VM 资源，不需要每个应用额外维护一份 `VM*Scrape`。
 
 ## Architecture
 

platform/observability/kustomization.yaml

@@ -3,6 +3,7 @@ kind: Kustomization
 resources:
   - namespace.yaml
   - helmrepository.yaml
+  - prometheus-helmrepository.yaml
   - grafana-helmrepository.yaml
   - operator
   - metrics

platform/observability/operator/kustomization.yaml

@@ -10,4 +10,5 @@ configMapGenerator:
     files:
       - values.yaml=values.yaml
 resources:
+  - prometheus-crds-helmrelease.yaml
   - helmrelease.yaml

platform/observability/operator/prometheus-crds-helmrelease.yaml

@@ -0,0 +1,29 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: prometheus-operator-crds
+  namespace: monitoring
+spec:
+  chart:
+    spec:
+      chart: prometheus-operator-crds
+      interval: 1h
+      sourceRef:
+        kind: HelmRepository
+        name: prometheus-community
+        namespace: monitoring
+      version: 32.0.0
+  install:
+    crds: CreateReplace
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 5m
+  interval: 30m
+  releaseName: prometheus-operator-crds
+  targetNamespace: monitoring
+  timeout: 10m
+  upgrade:
+    crds: CreateReplace
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 5m

platform/observability/prometheus-helmrepository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: prometheus-community
+  namespace: monitoring
+spec:
+  interval: 1h
+  url: https://prometheus-community.github.io/helm-charts