From e5710204df9ae8e3ca882378234aaa48940e8492 Mon Sep 17 00:00:00 2001
From: Joseph Hanson <joe@veri.dev>
Date: Sun, 6 Oct 2024 22:15:07 -0500
Subject: [PATCH] add vmalert

---
 .../cluster/kustomization.yaml                |  2 +-
 .../victoria-metrics/cluster/vmalert.yaml     | 20 +++++++++++--------
 2 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/kubernetes/apps/observability/victoria-metrics/cluster/kustomization.yaml b/kubernetes/apps/observability/victoria-metrics/cluster/kustomization.yaml
index 9afa3e7d..65711d6d 100644
--- a/kubernetes/apps/observability/victoria-metrics/cluster/kustomization.yaml
+++ b/kubernetes/apps/observability/victoria-metrics/cluster/kustomization.yaml
@@ -3,5 +3,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  # - vmalert.yaml
+  - vmalert.yaml
   - vmsingle.yaml
diff --git a/kubernetes/apps/observability/victoria-metrics/cluster/vmalert.yaml b/kubernetes/apps/observability/victoria-metrics/cluster/vmalert.yaml
index acce8a13..44f7afd9 100644
--- a/kubernetes/apps/observability/victoria-metrics/cluster/vmalert.yaml
+++ b/kubernetes/apps/observability/victoria-metrics/cluster/vmalert.yaml
@@ -5,22 +5,27 @@ kind: VMAlert
 metadata:
   name: cluster
 spec:
+  evaluationInterval: 1m
+  useStrictSecurity: true
+  selectAllByDefault: true
   datasource:
     url: http://vmsingle-cluster.observability.svc:8429
-  evaluationInterval: 1m
   notifiers:
     - url: http://alertmanager.observability.svc:9093
-  # remoteRead:
-  #   url: http://vmsingle-cluster.observability.svc:8429
-  # remoteWrite:
-  #   url: http://vmsingle-cluster.observability.svc:8429
-  replicaCount: 1
+  remoteRead:
+    url: http://vmsingle-cluster.observability.svc:8429
+  remoteWrite:
+    url: http://vmsingle-cluster.observability.svc:8429
+  securityContext:
+    runAsUser: 65534
+    runAsGroup: 65534
+    runAsNonRoot: true
+    fsGroup: 65534
   resources:
     requests:
       cpu: 3m
     limits:
       memory: 128Mi
-  selectAllByDefault: true
   topologySpreadConstraints:
     - maxSkew: 1
       topologyKey: kubernetes.io/hostname
@@ -29,4 +34,3 @@ spec:
         matchLabels:
           app.kubernetes.io/instance: cluster
           app.kubernetes.io/name: vmalert
-  useStrictSecurity: true