---
# kube-prometheus-stack — Prometheus + Alertmanager + Grafana (docs/10). Phase 0 STUB.
# Retention/sizes are overlay knobs (R-ENV-02). Alertmanager emails via SMTP.
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: kube-prometheus-stack
  namespace: monitoring
spec:
  interval: 30m
  chart:
    spec:
      chart: kube-prometheus-stack
      version: ">=65.0.0 <66.0.0"   # TODO(WS-OBS): pin at bring-up; Renovate maintains
      sourceRef:
        kind: HelmRepository
        name: prometheus-community
        namespace: monitoring
  install:
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  values:
    prometheus:
      prometheusSpec:
        retention: ${MONITORING_PROMETHEUS_RETENTION}     # overlay knob (dev short / prod long)
        storageSpec:
          volumeClaimTemplate:
            spec:
              storageClassName: longhorn                  # replicated tier (ADR-0003)
              resources:
                requests:
                  storage: ${MONITORING_PROMETHEUS_PVC_SIZE}
    grafana:
      # Grafana behind Keycloak SSO (native OIDC) — ADR-0014. C2 UI composition (docs/12).
      # TODO(WS-SEC/WS-C2): OIDC client + admin password from SOPS secret (name only).
      enabled: true
    alertmanager:
      alertmanagerSpec: {}
      # TODO(WS-OBS, Phase 4): Alertmanager → Gmail SMTP receiver; SMTP creds SOPS-encrypted (name
      #   only). Reconciliation errors + drift are alerting conditions (R-OBS-04). Prove: injected
      #   fault emails an alert (Phase-4 exit gate).