@bluedynamics/cdk8s-monitoring 0.0.1

package/lib/constructs/loki.js

@@ -0,0 +1,185 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LokiConstruct = void 0;
+const cdk8s_1 = require("cdk8s");
+const constructs_1 = require("constructs");
+/**
+ * Creates Loki HelmChart for log aggregation.
+ *
+ * This construct deploys Loki in SimpleScalable mode with:
+ * - Backend (2 replicas) - Index and compaction
+ * - Read (2 replicas) - Query processing
+ * - Write (2 replicas) - Log ingestion
+ * - Gateway (1 replica) - HTTP API endpoint
+ * - S3 storage backend (Hetzner Object Storage)
+ *
+ * Prerequisites:
+ * - Namespace exists
+ * - PriorityClass 'high-priority' exists
+ * - Longhorn storage class available
+ * - S3 bucket exists (via Crossplane)
+ * - S3 credentials secret exists (via LokiS3CredentialsConstruct)
+ *
+ * Sync Wave: 2 (core services - after S3 credentials secret)
+ */
+class LokiConstruct extends constructs_1.Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        const { namespace, config, s3CredentialsSecretName } = props;
+        // Generate Helm values YAML
+        const helmValues = this.generateHelmValues(config, s3CredentialsSecretName);
+        // Create HelmChart resource (K3S Helm controller)
+        // Wave 2: Core Services - log aggregation
+        new cdk8s_1.ApiObject(this, 'loki', {
+            apiVersion: 'helm.cattle.io/v1',
+            kind: 'HelmChart',
+            metadata: {
+                name: 'loki',
+                namespace: namespace,
+                labels: {
+                    'app.kubernetes.io/name': 'loki',
+                    'app.kubernetes.io/component': 'logging',
+                    'app.kubernetes.io/managed-by': 'cdk8s',
+                    'app.kubernetes.io/part-of': 'monitoring',
+                },
+                annotations: {
+                    'argocd.argoproj.io/sync-wave': '2',
+                },
+            },
+            spec: {
+                repo: 'https://grafana.github.io/helm-charts',
+                chart: 'loki',
+                version: config.versions.loki === 'latest' ? undefined : config.versions.loki,
+                targetNamespace: namespace,
+                valuesContent: helmValues,
+            },
+        });
+    }
+    generateHelmValues(config, s3CredentialsSecretName) {
+        // S3 credentials are injected via environment variables from a Kubernetes secret
+        // The secret is created by LokiS3CredentialsConstruct using ExternalSecrets
+        // Loki expands environment variables in config when -config.expand-env=true is set
+        return `deploymentMode: SimpleScalable
+
+loki:
+  auth_enabled: false
+
+  schemaConfig:
+    configs:
+      - from: 2024-01-01
+        store: tsdb
+        object_store: s3
+        schema: v13
+        index:
+          prefix: loki_index_
+          period: 24h
+
+  storage:
+    bucketNames:
+      chunks: ${config.s3.buckets.loki}
+      ruler: ${config.s3.buckets.loki}
+    type: s3
+    s3:
+      endpoint: ${config.s3.endpoint}
+      region: auto  # Dummy region for Hetzner S3 (endpoint determines actual location)
+      # Credentials are expanded from environment variables at runtime
+      secretAccessKey: \${AWS_SECRET_ACCESS_KEY}
+      accessKeyId: \${AWS_ACCESS_KEY_ID}
+      s3ForcePathStyle: false
+      insecure: false
+
+  limits_config:
+    allow_structured_metadata: true
+    max_streams_per_user: 100000
+    ingestion_rate_mb: 10
+    ingestion_burst_size_mb: 20
+    retention_period: ${config.retention.loki}
+    reject_old_samples: true
+    reject_old_samples_max_age: 168h
+
+  compactor:
+    retention_enabled: true
+    delete_request_store: s3
+
+backend:
+  replicas: ${config.replicas.lokiBackend}
+  extraArgs:
+    - "-config.expand-env=true"
+  extraEnvFrom:
+    - secretRef:
+        name: ${s3CredentialsSecretName}
+  resources:
+    limits:
+      cpu: ${config.resources.lokiBackend.limits.cpu}
+      memory: ${config.resources.lokiBackend.limits.memory}
+    requests:
+      cpu: ${config.resources.lokiBackend.requests.cpu}
+      memory: ${config.resources.lokiBackend.requests.memory}
+  persistence:
+    enabled: true
+    storageClass: longhorn
+    size: ${config.storage.lokiBackend}
+  priorityClassName: high-priority
+
+read:
+  replicas: ${config.replicas.lokiRead}
+  extraArgs:
+    - "-config.expand-env=true"
+  extraEnvFrom:
+    - secretRef:
+        name: ${s3CredentialsSecretName}
+  resources:
+    limits:
+      cpu: ${config.resources.lokiRead.limits.cpu}
+      memory: ${config.resources.lokiRead.limits.memory}
+    requests:
+      cpu: ${config.resources.lokiRead.requests.cpu}
+      memory: ${config.resources.lokiRead.requests.memory}
+  priorityClassName: high-priority
+
+write:
+  replicas: ${config.replicas.lokiWrite}
+  extraArgs:
+    - "-config.expand-env=true"
+  extraEnvFrom:
+    - secretRef:
+        name: ${s3CredentialsSecretName}
+  resources:
+    limits:
+      cpu: ${config.resources.lokiWrite.limits.cpu}
+      memory: ${config.resources.lokiWrite.limits.memory}
+    requests:
+      cpu: ${config.resources.lokiWrite.requests.cpu}
+      memory: ${config.resources.lokiWrite.requests.memory}
+  persistence:
+    enabled: true
+    storageClass: longhorn
+    size: ${config.storage.lokiWrite}
+  priorityClassName: high-priority
+
+gateway:
+  enabled: true
+  replicas: ${config.replicas.grafana}
+  resources:
+    limits:
+      cpu: ${config.resources.lokiGateway.limits.cpu}
+      memory: ${config.resources.lokiGateway.limits.memory}
+    requests:
+      cpu: ${config.resources.lokiGateway.requests.cpu}
+      memory: ${config.resources.lokiGateway.requests.memory}
+  priorityClassName: high-priority
+
+minio:
+  enabled: false
+
+# Disable memcached caches to reduce memory footprint
+# Memcached is an optimization for high query loads, not required for small clusters
+chunksCache:
+  enabled: false
+resultsCache:
+  enabled: false
+`;
+    }
+}
+exports.LokiConstruct = LokiConstruct;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibG9raS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jb25zdHJ1Y3RzL2xva2kudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsaUNBQWtDO0FBQ2xDLDJDQUF1QztBQVN2Qzs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBa0JHO0FBQ0gsTUFBYSxhQUFjLFNBQVEsc0JBQVM7SUFDMUMsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUFnQjtRQUN4RCxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBRWpCLE1BQU0sRUFBRSxTQUFTLEVBQUUsTUFBTSxFQUFFLHVCQUF1QixFQUFFLEdBQUcsS0FBSyxDQUFDO1FBRTdELDRCQUE0QjtRQUM1QixNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsa0JBQWtCLENBQUMsTUFBTSxFQUFFLHVCQUF1QixDQUFDLENBQUM7UUFFNUUsa0RBQWtEO1FBQ2xELDBDQUEwQztRQUMxQyxJQUFJLGlCQUFTLENBQUMsSUFBSSxFQUFFLE1BQU0sRUFBRTtZQUMxQixVQUFVLEVBQUUsbUJBQW1CO1lBQy9CLElBQUksRUFBRSxXQUFXO1lBQ2pCLFFBQVEsRUFBRTtnQkFDUixJQUFJLEVBQUUsTUFBTTtnQkFDWixTQUFTLEVBQUUsU0FBUztnQkFDcEIsTUFBTSxFQUFFO29CQUNOLHdCQUF3QixFQUFFLE1BQU07b0JBQ2hDLDZCQUE2QixFQUFFLFNBQVM7b0JBQ3hDLDhCQUE4QixFQUFFLE9BQU87b0JBQ3ZDLDJCQUEyQixFQUFFLFlBQVk7aUJBQzFDO2dCQUNELFdBQVcsRUFBRTtvQkFDWCw4QkFBOEIsRUFBRSxHQUFHO2lCQUNwQzthQUNGO1lBQ0QsSUFBSSxFQUFFO2dCQUNKLElBQUksRUFBRSx1Q0FBdUM7Z0JBQzdDLEtBQUssRUFBRSxNQUFNO2dCQUNiLE9BQU8sRUFBRSxNQUFNLENBQUMsUUFBUSxDQUFDLElBQUksS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxJQUFJO2dCQUM3RSxlQUFlLEVBQUUsU0FBUztnQkFDMUIsYUFBYSxFQUFFLFVBQVU7YUFDMUI7U0FDRixDQUFDLENBQUM7SUFDTCxDQUFDO0lBRU8sa0JBQWtCLENBQ3hCLE1BQXdCLEVBQ3hCLHVCQUErQjtRQUUvQixpRkFBaUY7UUFDakYsNEVBQTRFO1FBQzVFLG1GQUFtRjtRQUVuRixPQUFPOzs7Ozs7Ozs7Ozs7Ozs7OztnQkFpQkssTUFBTSxDQUFDLEVBQUUsQ0FBQyxPQUFPLENBQUMsSUFBSTtlQUN2QixNQUFNLENBQUMsRUFBRSxDQUFDLE9BQU8sQ0FBQyxJQUFJOzs7a0JBR25CLE1BQU0sQ0FBQyxFQUFFLENBQUMsUUFBUTs7Ozs7Ozs7Ozs7Ozt3QkFhWixNQUFNLENBQUMsU0FBUyxDQUFDLElBQUk7Ozs7Ozs7OztjQVMvQixNQUFNLENBQUMsUUFBUSxDQUFDLFdBQVc7Ozs7O2dCQUt6Qix1QkFBdUI7OzthQUcxQixNQUFNLENBQUMsU0FBUyxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsR0FBRztnQkFDcEMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxXQUFXLENBQUMsTUFBTSxDQUFDLE1BQU07O2FBRTdDLE1BQU0sQ0FBQyxTQUFTLENBQUMsV0FBVyxDQUFDLFFBQVEsQ0FBQyxHQUFHO2dCQUN0QyxNQUFNLENBQUMsU0FBUyxDQUFDLFdBQVcsQ0FBQyxRQUFRLENBQUMsTUFBTTs7OztZQUloRCxNQUFNLENBQUMsT0FBTyxDQUFDLFdBQVc7Ozs7Y0FJeEIsTUFBTSxDQUFDLFFBQVEsQ0FBQyxRQUFROzs7OztnQkFLdEIsdUJBQXVCOzs7YUFHMUIsTUFBTSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLEdBQUc7Z0JBQ2pDLE1BQU0sQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxNQUFNOzthQUUxQyxNQUFNLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsR0FBRztnQkFDbkMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLE1BQU07Ozs7Y0FJM0MsTUFBTSxDQUFDLFFBQVEsQ0FBQyxTQUFTOzs7OztnQkFLdkIsdUJBQXVCOzs7YUFHMUIsTUFBTSxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLEdBQUc7Z0JBQ2xDLE1BQU0sQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxNQUFNOzthQUUzQyxNQUFNLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsR0FBRztnQkFDcEMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLE1BQU07Ozs7WUFJOUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxTQUFTOzs7OztjQUt0QixNQUFNLENBQUMsUUFBUSxDQUFDLE9BQU87OzthQUd4QixNQUFNLENBQUMsU0FBUyxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsR0FBRztnQkFDcEMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxXQUFXLENBQUMsTUFBTSxDQUFDLE1BQU07O2FBRTdDLE1BQU0sQ0FBQyxTQUFTLENBQUMsV0FBVyxDQUFDLFFBQVEsQ0FBQyxHQUFHO2dCQUN0QyxNQUFNLENBQUMsU0FBUyxDQUFDLFdBQVcsQ0FBQyxRQUFRLENBQUMsTUFBTTs7Ozs7Ozs7Ozs7O0NBWTNELENBQUM7SUFDQSxDQUFDO0NBQ0Y7QUF0S0Qsc0NBc0tDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgQXBpT2JqZWN0IH0gZnJvbSAnY2RrOHMnO1xuaW1wb3J0IHsgQ29uc3RydWN0IH0gZnJvbSAnY29uc3RydWN0cyc7XG5pbXBvcnQgeyBNb25pdG9yaW5nQ29uZmlnIH0gZnJvbSAnLi4vdHlwZXMnO1xuXG5leHBvcnQgaW50ZXJmYWNlIExva2lQcm9wcyB7XG4gIG5hbWVzcGFjZTogc3RyaW5nO1xuICBjb25maWc6IE1vbml0b3JpbmdDb25maWc7XG4gIHMzQ3JlZGVudGlhbHNTZWNyZXROYW1lOiBzdHJpbmc7XG59XG5cbi8qKlxuICogQ3JlYXRlcyBMb2tpIEhlbG1DaGFydCBmb3IgbG9nIGFnZ3JlZ2F0aW9uLlxuICpcbiAqIFRoaXMgY29uc3RydWN0IGRlcGxveXMgTG9raSBpbiBTaW1wbGVTY2FsYWJsZSBtb2RlIHdpdGg6XG4gKiAtIEJhY2tlbmQgKDIgcmVwbGljYXMpIC0gSW5kZXggYW5kIGNvbXBhY3Rpb25cbiAqIC0gUmVhZCAoMiByZXBsaWNhcykgLSBRdWVyeSBwcm9jZXNzaW5nXG4gKiAtIFdyaXRlICgyIHJlcGxpY2FzKSAtIExvZyBpbmdlc3Rpb25cbiAqIC0gR2F0ZXdheSAoMSByZXBsaWNhKSAtIEhUVFAgQVBJIGVuZHBvaW50XG4gKiAtIFMzIHN0b3JhZ2UgYmFja2VuZCAoSGV0em5lciBPYmplY3QgU3RvcmFnZSlcbiAqXG4gKiBQcmVyZXF1aXNpdGVzOlxuICogLSBOYW1lc3BhY2UgZXhpc3RzXG4gKiAtIFByaW9yaXR5Q2xhc3MgJ2hpZ2gtcHJpb3JpdHknIGV4aXN0c1xuICogLSBMb25naG9ybiBzdG9yYWdlIGNsYXNzIGF2YWlsYWJsZVxuICogLSBTMyBidWNrZXQgZXhpc3RzICh2aWEgQ3Jvc3NwbGFuZSlcbiAqIC0gUzMgY3JlZGVudGlhbHMgc2VjcmV0IGV4aXN0cyAodmlhIExva2lTM0NyZWRlbnRpYWxzQ29uc3RydWN0KVxuICpcbiAqIFN5bmMgV2F2ZTogMiAoY29yZSBzZXJ2aWNlcyAtIGFmdGVyIFMzIGNyZWRlbnRpYWxzIHNlY3JldClcbiAqL1xuZXhwb3J0IGNsYXNzIExva2lDb25zdHJ1Y3QgZXh0ZW5kcyBDb25zdHJ1Y3Qge1xuICBjb25zdHJ1Y3RvcihzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nLCBwcm9wczogTG9raVByb3BzKSB7XG4gICAgc3VwZXIoc2NvcGUsIGlkKTtcblxuICAgIGNvbnN0IHsgbmFtZXNwYWNlLCBjb25maWcsIHMzQ3JlZGVudGlhbHNTZWNyZXROYW1lIH0gPSBwcm9wcztcblxuICAgIC8vIEdlbmVyYXRlIEhlbG0gdmFsdWVzIFlBTUxcbiAgICBjb25zdCBoZWxtVmFsdWVzID0gdGhpcy5nZW5lcmF0ZUhlbG1WYWx1ZXMoY29uZmlnLCBzM0NyZWRlbnRpYWxzU2VjcmV0TmFtZSk7XG5cbiAgICAvLyBDcmVhdGUgSGVsbUNoYXJ0IHJlc291cmNlIChLM1MgSGVsbSBjb250cm9sbGVyKVxuICAgIC8vIFdhdmUgMjogQ29yZSBTZXJ2aWNlcyAtIGxvZyBhZ2dyZWdhdGlvblxuICAgIG5ldyBBcGlPYmplY3QodGhpcywgJ2xva2knLCB7XG4gICAgICBhcGlWZXJzaW9uOiAnaGVsbS5jYXR0bGUuaW8vdjEnLFxuICAgICAga2luZDogJ0hlbG1DaGFydCcsXG4gICAgICBtZXRhZGF0YToge1xuICAgICAgICBuYW1lOiAnbG9raScsXG4gICAgICAgIG5hbWVzcGFjZTogbmFtZXNwYWNlLFxuICAgICAgICBsYWJlbHM6IHtcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vbmFtZSc6ICdsb2tpJyxcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vY29tcG9uZW50JzogJ2xvZ2dpbmcnLFxuICAgICAgICAgICdhcHAua3ViZXJuZXRlcy5pby9tYW5hZ2VkLWJ5JzogJ2NkazhzJyxcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZic6ICdtb25pdG9yaW5nJyxcbiAgICAgICAgfSxcbiAgICAgICAgYW5ub3RhdGlvbnM6IHtcbiAgICAgICAgICAnYXJnb2NkLmFyZ29wcm9qLmlvL3N5bmMtd2F2ZSc6ICcyJyxcbiAgICAgICAgfSxcbiAgICAgIH0sXG4gICAgICBzcGVjOiB7XG4gICAgICAgIHJlcG86ICdodHRwczovL2dyYWZhbmEuZ2l0aHViLmlvL2hlbG0tY2hhcnRzJyxcbiAgICAgICAgY2hhcnQ6ICdsb2tpJyxcbiAgICAgICAgdmVyc2lvbjogY29uZmlnLnZlcnNpb25zLmxva2kgPT09ICdsYXRlc3QnID8gdW5kZWZpbmVkIDogY29uZmlnLnZlcnNpb25zLmxva2ksXG4gICAgICAgIHRhcmdldE5hbWVzcGFjZTogbmFtZXNwYWNlLFxuICAgICAgICB2YWx1ZXNDb250ZW50OiBoZWxtVmFsdWVzLFxuICAgICAgfSxcbiAgICB9KTtcbiAgfVxuXG4gIHByaXZhdGUgZ2VuZXJhdGVIZWxtVmFsdWVzKFxuICAgIGNvbmZpZzogTW9uaXRvcmluZ0NvbmZpZyxcbiAgICBzM0NyZWRlbnRpYWxzU2VjcmV0TmFtZTogc3RyaW5nLFxuICApOiBzdHJpbmcge1xuICAgIC8vIFMzIGNyZWRlbnRpYWxzIGFyZSBpbmplY3RlZCB2aWEgZW52aXJvbm1lbnQgdmFyaWFibGVzIGZyb20gYSBLdWJlcm5ldGVzIHNlY3JldFxuICAgIC8vIFRoZSBzZWNyZXQgaXMgY3JlYXRlZCBieSBMb2tpUzNDcmVkZW50aWFsc0NvbnN0cnVjdCB1c2luZyBFeHRlcm5hbFNlY3JldHNcbiAgICAvLyBMb2tpIGV4cGFuZHMgZW52aXJvbm1lbnQgdmFyaWFibGVzIGluIGNvbmZpZyB3aGVuIC1jb25maWcuZXhwYW5kLWVudj10cnVlIGlzIHNldFxuXG4gICAgcmV0dXJuIGBkZXBsb3ltZW50TW9kZTogU2ltcGxlU2NhbGFibGVcblxubG9raTpcbiAgYXV0aF9lbmFibGVkOiBmYWxzZVxuXG4gIHNjaGVtYUNvbmZpZzpcbiAgICBjb25maWdzOlxuICAgICAgLSBmcm9tOiAyMDI0LTAxLTAxXG4gICAgICAgIHN0b3JlOiB0c2RiXG4gICAgICAgIG9iamVjdF9zdG9yZTogczNcbiAgICAgICAgc2NoZW1hOiB2MTNcbiAgICAgICAgaW5kZXg6XG4gICAgICAgICAgcHJlZml4OiBsb2tpX2luZGV4X1xuICAgICAgICAgIHBlcmlvZDogMjRoXG5cbiAgc3RvcmFnZTpcbiAgICBidWNrZXROYW1lczpcbiAgICAgIGNodW5rczogJHtjb25maWcuczMuYnVja2V0cy5sb2tpfVxuICAgICAgcnVsZXI6ICR7Y29uZmlnLnMzLmJ1Y2tldHMubG9raX1cbiAgICB0eXBlOiBzM1xuICAgIHMzOlxuICAgICAgZW5kcG9pbnQ6ICR7Y29uZmlnLnMzLmVuZHBvaW50fVxuICAgICAgcmVnaW9uOiBhdXRvICAjIER1bW15IHJlZ2lvbiBmb3IgSGV0em5lciBTMyAoZW5kcG9pbnQgZGV0ZXJtaW5lcyBhY3R1YWwgbG9jYXRpb24pXG4gICAgICAjIENyZWRlbnRpYWxzIGFyZSBleHBhbmRlZCBmcm9tIGVudmlyb25tZW50IHZhcmlhYmxlcyBhdCBydW50aW1lXG4gICAgICBzZWNyZXRBY2Nlc3NLZXk6IFxcJHtBV1NfU0VDUkVUX0FDQ0VTU19LRVl9XG4gICAgICBhY2Nlc3NLZXlJZDogXFwke0FXU19BQ0NFU1NfS0VZX0lEfVxuICAgICAgczNGb3JjZVBhdGhTdHlsZTogZmFsc2VcbiAgICAgIGluc2VjdXJlOiBmYWxzZVxuXG4gIGxpbWl0c19jb25maWc6XG4gICAgYWxsb3dfc3RydWN0dXJlZF9tZXRhZGF0YTogdHJ1ZVxuICAgIG1heF9zdHJlYW1zX3Blcl91c2VyOiAxMDAwMDBcbiAgICBpbmdlc3Rpb25fcmF0ZV9tYjogMTBcbiAgICBpbmdlc3Rpb25fYnVyc3Rfc2l6ZV9tYjogMjBcbiAgICByZXRlbnRpb25fcGVyaW9kOiAke2NvbmZpZy5yZXRlbnRpb24ubG9raX1cbiAgICByZWplY3Rfb2xkX3NhbXBsZXM6IHRydWVcbiAgICByZWplY3Rfb2xkX3NhbXBsZXNfbWF4X2FnZTogMTY4aFxuXG4gIGNvbXBhY3RvcjpcbiAgICByZXRlbnRpb25fZW5hYmxlZDogdHJ1ZVxuICAgIGRlbGV0ZV9yZXF1ZXN0X3N0b3JlOiBzM1xuXG5iYWNrZW5kOlxuICByZXBsaWNhczogJHtjb25maWcucmVwbGljYXMubG9raUJhY2tlbmR9XG4gIGV4dHJhQXJnczpcbiAgICAtIFwiLWNvbmZpZy5leHBhbmQtZW52PXRydWVcIlxuICBleHRyYUVudkZyb206XG4gICAgLSBzZWNyZXRSZWY6XG4gICAgICAgIG5hbWU6ICR7czNDcmVkZW50aWFsc1NlY3JldE5hbWV9XG4gIHJlc291cmNlczpcbiAgICBsaW1pdHM6XG4gICAgICBjcHU6ICR7Y29uZmlnLnJlc291cmNlcy5sb2tpQmFja2VuZC5saW1pdHMuY3B1fVxuICAgICAgbWVtb3J5OiAke2NvbmZpZy5yZXNvdXJjZXMubG9raUJhY2tlbmQubGltaXRzLm1lbW9yeX1cbiAgICByZXF1ZXN0czpcbiAgICAgIGNwdTogJHtjb25maWcucmVzb3VyY2VzLmxva2lCYWNrZW5kLnJlcXVlc3RzLmNwdX1cbiAgICAgIG1lbW9yeTogJHtjb25maWcucmVzb3VyY2VzLmxva2lCYWNrZW5kLnJlcXVlc3RzLm1lbW9yeX1cbiAgcGVyc2lzdGVuY2U6XG4gICAgZW5hYmxlZDogdHJ1ZVxuICAgIHN0b3JhZ2VDbGFzczogbG9uZ2hvcm5cbiAgICBzaXplOiAke2NvbmZpZy5zdG9yYWdlLmxva2lCYWNrZW5kfVxuICBwcmlvcml0eUNsYXNzTmFtZTogaGlnaC1wcmlvcml0eVxuXG5yZWFkOlxuICByZXBsaWNhczogJHtjb25maWcucmVwbGljYXMubG9raVJlYWR9XG4gIGV4dHJhQXJnczpcbiAgICAtIFwiLWNvbmZpZy5leHBhbmQtZW52PXRydWVcIlxuICBleHRyYUVudkZyb206XG4gICAgLSBzZWNyZXRSZWY6XG4gICAgICAgIG5hbWU6ICR7czNDcmVkZW50aWFsc1NlY3JldE5hbWV9XG4gIHJlc291cmNlczpcbiAgICBsaW1pdHM6XG4gICAgICBjcHU6ICR7Y29uZmlnLnJlc291cmNlcy5sb2tpUmVhZC5saW1pdHMuY3B1fVxuICAgICAgbWVtb3J5OiAke2NvbmZpZy5yZXNvdXJjZXMubG9raVJlYWQubGltaXRzLm1lbW9yeX1cbiAgICByZXF1ZXN0czpcbiAgICAgIGNwdTogJHtjb25maWcucmVzb3VyY2VzLmxva2lSZWFkLnJlcXVlc3RzLmNwdX1cbiAgICAgIG1lbW9yeTogJHtjb25maWcucmVzb3VyY2VzLmxva2lSZWFkLnJlcXVlc3RzLm1lbW9yeX1cbiAgcHJpb3JpdHlDbGFzc05hbWU6IGhpZ2gtcHJpb3JpdHlcblxud3JpdGU6XG4gIHJlcGxpY2FzOiAke2NvbmZpZy5yZXBsaWNhcy5sb2tpV3JpdGV9XG4gIGV4dHJhQXJnczpcbiAgICAtIFwiLWNvbmZpZy5leHBhbmQtZW52PXRydWVcIlxuICBleHRyYUVudkZyb206XG4gICAgLSBzZWNyZXRSZWY6XG4gICAgICAgIG5hbWU6ICR7czNDcmVkZW50aWFsc1NlY3JldE5hbWV9XG4gIHJlc291cmNlczpcbiAgICBsaW1pdHM6XG4gICAgICBjcHU6ICR7Y29uZmlnLnJlc291cmNlcy5sb2tpV3JpdGUubGltaXRzLmNwdX1cbiAgICAgIG1lbW9yeTogJHtjb25maWcucmVzb3VyY2VzLmxva2lXcml0ZS5saW1pdHMubWVtb3J5fVxuICAgIHJlcXVlc3RzOlxuICAgICAgY3B1OiAke2NvbmZpZy5yZXNvdXJjZXMubG9raVdyaXRlLnJlcXVlc3RzLmNwdX1cbiAgICAgIG1lbW9yeTogJHtjb25maWcucmVzb3VyY2VzLmxva2lXcml0ZS5yZXF1ZXN0cy5tZW1vcnl9XG4gIHBlcnNpc3RlbmNlOlxuICAgIGVuYWJsZWQ6IHRydWVcbiAgICBzdG9yYWdlQ2xhc3M6IGxvbmdob3JuXG4gICAgc2l6ZTogJHtjb25maWcuc3RvcmFnZS5sb2tpV3JpdGV9XG4gIHByaW9yaXR5Q2xhc3NOYW1lOiBoaWdoLXByaW9yaXR5XG5cbmdhdGV3YXk6XG4gIGVuYWJsZWQ6IHRydWVcbiAgcmVwbGljYXM6ICR7Y29uZmlnLnJlcGxpY2FzLmdyYWZhbmF9XG4gIHJlc291cmNlczpcbiAgICBsaW1pdHM6XG4gICAgICBjcHU6ICR7Y29uZmlnLnJlc291cmNlcy5sb2tpR2F0ZXdheS5saW1pdHMuY3B1fVxuICAgICAgbWVtb3J5OiAke2NvbmZpZy5yZXNvdXJjZXMubG9raUdhdGV3YXkubGltaXRzLm1lbW9yeX1cbiAgICByZXF1ZXN0czpcbiAgICAgIGNwdTogJHtjb25maWcucmVzb3VyY2VzLmxva2lHYXRld2F5LnJlcXVlc3RzLmNwdX1cbiAgICAgIG1lbW9yeTogJHtjb25maWcucmVzb3VyY2VzLmxva2lHYXRld2F5LnJlcXVlc3RzLm1lbW9yeX1cbiAgcHJpb3JpdHlDbGFzc05hbWU6IGhpZ2gtcHJpb3JpdHlcblxubWluaW86XG4gIGVuYWJsZWQ6IGZhbHNlXG5cbiMgRGlzYWJsZSBtZW1jYWNoZWQgY2FjaGVzIHRvIHJlZHVjZSBtZW1vcnkgZm9vdHByaW50XG4jIE1lbWNhY2hlZCBpcyBhbiBvcHRpbWl6YXRpb24gZm9yIGhpZ2ggcXVlcnkgbG9hZHMsIG5vdCByZXF1aXJlZCBmb3Igc21hbGwgY2x1c3RlcnNcbmNodW5rc0NhY2hlOlxuICBlbmFibGVkOiBmYWxzZVxucmVzdWx0c0NhY2hlOlxuICBlbmFibGVkOiBmYWxzZVxuYDtcbiAgfVxufVxuIl19

package/lib/constructs/namespace.d.ts

@@ -0,0 +1,13 @@
+import { Construct } from 'constructs';
+export interface NamespaceProps {
+    name: string;
+}
+/**
+ * Creates the monitoring namespace with proper labels and ArgoCD sync-wave annotation.
+ *
+ * Sync Wave: 0 (foundation - must exist before any other resources)
+ */
+export declare class NamespaceConstruct extends Construct {
+    readonly name: string;
+    constructor(scope: Construct, id: string, props: NamespaceProps);
+}

package/lib/constructs/namespace.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NamespaceConstruct = void 0;
+const constructs_1 = require("constructs");
+const k8s_1 = require("../imports/k8s");
+/**
+ * Creates the monitoring namespace with proper labels and ArgoCD sync-wave annotation.
+ *
+ * Sync Wave: 0 (foundation - must exist before any other resources)
+ */
+class NamespaceConstruct extends constructs_1.Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        this.name = props.name;
+        // Create namespace
+        // Wave 0: Foundation - must exist before any other resources
+        new k8s_1.KubeNamespace(this, 'namespace', {
+            metadata: {
+                name: props.name,
+                annotations: {
+                    'argocd.argoproj.io/sync-wave': '0',
+                },
+                labels: {
+                    'name': props.name,
+                    'app.kubernetes.io/name': 'monitoring',
+                    'app.kubernetes.io/component': 'observability',
+                    'app.kubernetes.io/managed-by': 'cdk8s',
+                },
+            },
+        });
+    }
+}
+exports.NamespaceConstruct = NamespaceConstruct;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmFtZXNwYWNlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2NvbnN0cnVjdHMvbmFtZXNwYWNlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLDJDQUF1QztBQUN2Qyx3Q0FBK0M7QUFNL0M7Ozs7R0FJRztBQUNILE1BQWEsa0JBQW1CLFNBQVEsc0JBQVM7SUFHL0MsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUFxQjtRQUM3RCxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBRWpCLElBQUksQ0FBQyxJQUFJLEdBQUcsS0FBSyxDQUFDLElBQUksQ0FBQztRQUV2QixtQkFBbUI7UUFDbkIsNkRBQTZEO1FBQzdELElBQUksbUJBQWEsQ0FBQyxJQUFJLEVBQUUsV0FBVyxFQUFFO1lBQ25DLFFBQVEsRUFBRTtnQkFDUixJQUFJLEVBQUUsS0FBSyxDQUFDLElBQUk7Z0JBQ2hCLFdBQVcsRUFBRTtvQkFDWCw4QkFBOEIsRUFBRSxHQUFHO2lCQUNwQztnQkFDRCxNQUFNLEVBQUU7b0JBQ04sTUFBTSxFQUFFLEtBQUssQ0FBQyxJQUFJO29CQUNsQix3QkFBd0IsRUFBRSxZQUFZO29CQUN0Qyw2QkFBNkIsRUFBRSxlQUFlO29CQUM5Qyw4QkFBOEIsRUFBRSxPQUFPO2lCQUN4QzthQUNGO1NBQ0YsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztDQUNGO0FBekJELGdEQXlCQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gJ2NvbnN0cnVjdHMnO1xuaW1wb3J0IHsgS3ViZU5hbWVzcGFjZSB9IGZyb20gJy4uL2ltcG9ydHMvazhzJztcblxuZXhwb3J0IGludGVyZmFjZSBOYW1lc3BhY2VQcm9wcyB7XG4gIG5hbWU6IHN0cmluZztcbn1cblxuLyoqXG4gKiBDcmVhdGVzIHRoZSBtb25pdG9yaW5nIG5hbWVzcGFjZSB3aXRoIHByb3BlciBsYWJlbHMgYW5kIEFyZ29DRCBzeW5jLXdhdmUgYW5ub3RhdGlvbi5cbiAqXG4gKiBTeW5jIFdhdmU6IDAgKGZvdW5kYXRpb24gLSBtdXN0IGV4aXN0IGJlZm9yZSBhbnkgb3RoZXIgcmVzb3VyY2VzKVxuICovXG5leHBvcnQgY2xhc3MgTmFtZXNwYWNlQ29uc3RydWN0IGV4dGVuZHMgQ29uc3RydWN0IHtcbiAgcHVibGljIHJlYWRvbmx5IG5hbWU6IHN0cmluZztcblxuICBjb25zdHJ1Y3RvcihzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nLCBwcm9wczogTmFtZXNwYWNlUHJvcHMpIHtcbiAgICBzdXBlcihzY29wZSwgaWQpO1xuXG4gICAgdGhpcy5uYW1lID0gcHJvcHMubmFtZTtcblxuICAgIC8vIENyZWF0ZSBuYW1lc3BhY2VcbiAgICAvLyBXYXZlIDA6IEZvdW5kYXRpb24gLSBtdXN0IGV4aXN0IGJlZm9yZSBhbnkgb3RoZXIgcmVzb3VyY2VzXG4gICAgbmV3IEt1YmVOYW1lc3BhY2UodGhpcywgJ25hbWVzcGFjZScsIHtcbiAgICAgIG1ldGFkYXRhOiB7XG4gICAgICAgIG5hbWU6IHByb3BzLm5hbWUsXG4gICAgICAgIGFubm90YXRpb25zOiB7XG4gICAgICAgICAgJ2FyZ29jZC5hcmdvcHJvai5pby9zeW5jLXdhdmUnOiAnMCcsXG4gICAgICAgIH0sXG4gICAgICAgIGxhYmVsczoge1xuICAgICAgICAgICduYW1lJzogcHJvcHMubmFtZSxcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vbmFtZSc6ICdtb25pdG9yaW5nJyxcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vY29tcG9uZW50JzogJ29ic2VydmFiaWxpdHknLFxuICAgICAgICAgICdhcHAua3ViZXJuZXRlcy5pby9tYW5hZ2VkLWJ5JzogJ2NkazhzJyxcbiAgICAgICAgfSxcbiAgICAgIH0sXG4gICAgfSk7XG4gIH1cbn1cbiJdfQ==

package/lib/constructs/priority-class.d.ts

@@ -0,0 +1,12 @@
+import { Construct } from 'constructs';
+/**
+ * Creates a high-priority PriorityClass for monitoring components.
+ *
+ * PriorityClass ensures monitoring pods are scheduled with higher priority
+ * than regular workloads, preventing eviction during resource pressure.
+ *
+ * Sync Wave: 0 (foundation - must exist before pods reference it)
+ */
+export declare class PriorityClassConstruct extends Construct {
+    constructor(scope: Construct, id: string);
+}

package/lib/constructs/priority-class.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PriorityClassConstruct = void 0;
+const constructs_1 = require("constructs");
+const k8s_1 = require("../imports/k8s");
+/**
+ * Creates a high-priority PriorityClass for monitoring components.
+ *
+ * PriorityClass ensures monitoring pods are scheduled with higher priority
+ * than regular workloads, preventing eviction during resource pressure.
+ *
+ * Sync Wave: 0 (foundation - must exist before pods reference it)
+ */
+class PriorityClassConstruct extends constructs_1.Construct {
+    constructor(scope, id) {
+        super(scope, id);
+        // Create PriorityClass
+        // Wave 0: Foundation - must exist before pods can reference it
+        new k8s_1.KubePriorityClass(this, 'high-priority', {
+            metadata: {
+                name: 'high-priority',
+                labels: {
+                    'app.kubernetes.io/name': 'high-priority',
+                    'app.kubernetes.io/component': 'scheduling',
+                    'app.kubernetes.io/managed-by': 'cdk8s',
+                },
+                annotations: {
+                    'argocd.argoproj.io/sync-wave': '0',
+                },
+            },
+            value: 10000,
+            globalDefault: false,
+            description: 'Use this class for high-priority pods only.',
+        });
+    }
+}
+exports.PriorityClassConstruct = PriorityClassConstruct;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJpb3JpdHktY2xhc3MuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY29uc3RydWN0cy9wcmlvcml0eS1jbGFzcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSwyQ0FBdUM7QUFDdkMsd0NBQW1EO0FBRW5EOzs7Ozs7O0dBT0c7QUFDSCxNQUFhLHNCQUF1QixTQUFRLHNCQUFTO0lBQ25ELFlBQVksS0FBZ0IsRUFBRSxFQUFVO1FBQ3RDLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFFakIsdUJBQXVCO1FBQ3ZCLCtEQUErRDtRQUMvRCxJQUFJLHVCQUFpQixDQUFDLElBQUksRUFBRSxlQUFlLEVBQUU7WUFDM0MsUUFBUSxFQUFFO2dCQUNSLElBQUksRUFBRSxlQUFlO2dCQUNyQixNQUFNLEVBQUU7b0JBQ04sd0JBQXdCLEVBQUUsZUFBZTtvQkFDekMsNkJBQTZCLEVBQUUsWUFBWTtvQkFDM0MsOEJBQThCLEVBQUUsT0FBTztpQkFDeEM7Z0JBQ0QsV0FBVyxFQUFFO29CQUNYLDhCQUE4QixFQUFFLEdBQUc7aUJBQ3BDO2FBQ0Y7WUFDRCxLQUFLLEVBQUUsS0FBSztZQUNaLGFBQWEsRUFBRSxLQUFLO1lBQ3BCLFdBQVcsRUFBRSw2Q0FBNkM7U0FDM0QsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztDQUNGO0FBdkJELHdEQXVCQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gJ2NvbnN0cnVjdHMnO1xuaW1wb3J0IHsgS3ViZVByaW9yaXR5Q2xhc3MgfSBmcm9tICcuLi9pbXBvcnRzL2s4cyc7XG5cbi8qKlxuICogQ3JlYXRlcyBhIGhpZ2gtcHJpb3JpdHkgUHJpb3JpdHlDbGFzcyBmb3IgbW9uaXRvcmluZyBjb21wb25lbnRzLlxuICpcbiAqIFByaW9yaXR5Q2xhc3MgZW5zdXJlcyBtb25pdG9yaW5nIHBvZHMgYXJlIHNjaGVkdWxlZCB3aXRoIGhpZ2hlciBwcmlvcml0eVxuICogdGhhbiByZWd1bGFyIHdvcmtsb2FkcywgcHJldmVudGluZyBldmljdGlvbiBkdXJpbmcgcmVzb3VyY2UgcHJlc3N1cmUuXG4gKlxuICogU3luYyBXYXZlOiAwIChmb3VuZGF0aW9uIC0gbXVzdCBleGlzdCBiZWZvcmUgcG9kcyByZWZlcmVuY2UgaXQpXG4gKi9cbmV4cG9ydCBjbGFzcyBQcmlvcml0eUNsYXNzQ29uc3RydWN0IGV4dGVuZHMgQ29uc3RydWN0IHtcbiAgY29uc3RydWN0b3Ioc2NvcGU6IENvbnN0cnVjdCwgaWQ6IHN0cmluZykge1xuICAgIHN1cGVyKHNjb3BlLCBpZCk7XG5cbiAgICAvLyBDcmVhdGUgUHJpb3JpdHlDbGFzc1xuICAgIC8vIFdhdmUgMDogRm91bmRhdGlvbiAtIG11c3QgZXhpc3QgYmVmb3JlIHBvZHMgY2FuIHJlZmVyZW5jZSBpdFxuICAgIG5ldyBLdWJlUHJpb3JpdHlDbGFzcyh0aGlzLCAnaGlnaC1wcmlvcml0eScsIHtcbiAgICAgIG1ldGFkYXRhOiB7XG4gICAgICAgIG5hbWU6ICdoaWdoLXByaW9yaXR5JyxcbiAgICAgICAgbGFiZWxzOiB7XG4gICAgICAgICAgJ2FwcC5rdWJlcm5ldGVzLmlvL25hbWUnOiAnaGlnaC1wcmlvcml0eScsXG4gICAgICAgICAgJ2FwcC5rdWJlcm5ldGVzLmlvL2NvbXBvbmVudCc6ICdzY2hlZHVsaW5nJyxcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vbWFuYWdlZC1ieSc6ICdjZGs4cycsXG4gICAgICAgIH0sXG4gICAgICAgIGFubm90YXRpb25zOiB7XG4gICAgICAgICAgJ2FyZ29jZC5hcmdvcHJvai5pby9zeW5jLXdhdmUnOiAnMCcsXG4gICAgICAgIH0sXG4gICAgICB9LFxuICAgICAgdmFsdWU6IDEwMDAwLFxuICAgICAgZ2xvYmFsRGVmYXVsdDogZmFsc2UsXG4gICAgICBkZXNjcmlwdGlvbjogJ1VzZSB0aGlzIGNsYXNzIGZvciBoaWdoLXByaW9yaXR5IHBvZHMgb25seS4nLFxuICAgIH0pO1xuICB9XG59XG4iXX0=

package/lib/constructs/prometheus-stack.d.ts

@@ -0,0 +1,30 @@
+import { Construct } from 'constructs';
+import { MonitoringConfig } from '../types';
+export interface PrometheusStackProps {
+    namespace: string;
+    config: MonitoringConfig;
+}
+/**
+ * Creates kube-prometheus-stack HelmChart with Prometheus, Grafana, and Alertmanager.
+ *
+ * This is the core monitoring stack that includes:
+ * - Prometheus (metrics collection, 2 replicas, 3d retention)
+ * - Grafana (visualization, ingress with Let's Encrypt)
+ * - Alertmanager (alert routing, SMTP notifications)
+ * - Prometheus Operator (manages Prometheus CRDs)
+ * - Node Exporter (system metrics DaemonSet)
+ * - kube-state-metrics (Kubernetes resource metrics)
+ *
+ * Prerequisites:
+ * - Namespace exists
+ * - PriorityClass 'high-priority' exists
+ * - Longhorn storage class available
+ * - cert-manager ClusterIssuer configured
+ * - Thanos S3 secret exists (thanos-objstore-config)
+ *
+ * Sync Wave: 2 (core services - after S3 buckets and secrets)
+ */
+export declare class PrometheusStackConstruct extends Construct {
+    constructor(scope: Construct, id: string, props: PrometheusStackProps);
+    private generateHelmValues;
+}