@bluedynamics/cdk8s-monitoring 0.0.1

package/lib/constructs/thanos-s3-bucket.js

@@ -0,0 +1,147 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ThanosS3BucketConstruct = void 0;
+const cdk8s_1 = require("cdk8s");
+const constructs_1 = require("constructs");
+const s3_aws_upbound_io_1 = require("../imports/s3.aws.upbound.io");
+/**
+ * Creates Crossplane Bucket resources for Thanos long-term metrics storage.
+ *
+ * This construct generates:
+ * - S3 Bucket (via Crossplane Upbound provider-aws-s3)
+ * - BucketVersioning (for recovery)
+ * - BucketLifecycleConfiguration (2-year retention)
+ *
+ * Prerequisites:
+ * - Crossplane operator installed
+ * - Upbound provider-aws-s3 installed
+ * - ProviderConfig 'hetzner-s3' configured (points to Hetzner S3)
+ * - Hetzner S3 credentials secret exists in crossplane-system
+ *
+ * Sync Wave: 1 (external dependencies - must exist before pods access S3)
+ */
+class ThanosS3BucketConstruct extends constructs_1.Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        const { config } = props;
+        const bucketName = config.s3.buckets.thanos;
+        const region = config.s3.region;
+        // Create Bucket
+        // Wave 1: External Dependencies - S3 bucket provisioned by Crossplane
+        // Note: Using ApiObject because cdk8s import limitations prevent importing Bucket type
+        new cdk8s_1.ApiObject(this, 'bucket', {
+            apiVersion: 's3.aws.upbound.io/v1beta2',
+            kind: 'Bucket',
+            metadata: {
+                name: bucketName,
+                namespace: 'crossplane-system',
+                labels: {
+                    'app.kubernetes.io/name': 'thanos',
+                    'app.kubernetes.io/component': 'storage',
+                    'app.kubernetes.io/managed-by': 'cdk8s',
+                    'app.kubernetes.io/part-of': 'monitoring',
+                },
+                annotations: {
+                    'argocd.argoproj.io/sync-wave': '1',
+                    'crossplane.io/external-name': bucketName,
+                    'description': 'Thanos long-term metrics storage (2-year retention)',
+                },
+            },
+            spec: {
+                deletionPolicy: 'Delete',
+                managementPolicies: [
+                    'Observe',
+                    'Create',
+                    'Delete',
+                    // Skip Update to avoid tagging operations (not supported by Hetzner S3)
+                ],
+                forProvider: {
+                    region: region, // Production region (endpoint determines actual location)
+                },
+                providerConfigRef: {
+                    name: 'hetzner-s3',
+                },
+            },
+        });
+        // Create BucketVersioning
+        // Enable versioning for bucket recovery
+        // Note: Using ApiObject because cdk8s import limitations prevent importing BucketVersioning type
+        new cdk8s_1.ApiObject(this, 'versioning', {
+            apiVersion: 's3.aws.upbound.io/v1beta2',
+            kind: 'BucketVersioning',
+            metadata: {
+                name: 'thanos-metrics-versioning',
+                namespace: 'crossplane-system',
+                labels: {
+                    'app.kubernetes.io/name': 'thanos',
+                    'app.kubernetes.io/component': 'storage',
+                    'app.kubernetes.io/managed-by': 'cdk8s',
+                    'app.kubernetes.io/part-of': 'monitoring',
+                },
+                annotations: {
+                    'argocd.argoproj.io/sync-wave': '1',
+                },
+            },
+            spec: {
+                forProvider: {
+                    region: region, // Production region (same as bucket)
+                    bucketRef: {
+                        name: bucketName,
+                    },
+                    versioningConfiguration: {
+                        status: 'Enabled',
+                    },
+                },
+                providerConfigRef: {
+                    name: 'hetzner-s3',
+                },
+            },
+        });
+        // Create BucketLifecycleConfiguration
+        // Lifecycle policy: Delete downsampled blocks after 2 years (cost control)
+        new s3_aws_upbound_io_1.BucketLifecycleConfiguration(this, 'lifecycle', {
+            metadata: {
+                name: 'thanos-metrics-lifecycle',
+                namespace: 'crossplane-system',
+                labels: {
+                    'app.kubernetes.io/name': 'thanos',
+                    'app.kubernetes.io/component': 'storage',
+                    'app.kubernetes.io/managed-by': 'cdk8s',
+                    'app.kubernetes.io/part-of': 'monitoring',
+                },
+                annotations: {
+                    'argocd.argoproj.io/sync-wave': '1',
+                },
+            },
+            spec: {
+                managementPolicies: [
+                    s3_aws_upbound_io_1.BucketLifecycleConfigurationSpecManagementPolicies.OBSERVE,
+                    s3_aws_upbound_io_1.BucketLifecycleConfigurationSpecManagementPolicies.CREATE,
+                    s3_aws_upbound_io_1.BucketLifecycleConfigurationSpecManagementPolicies.DELETE,
+                ],
+                forProvider: {
+                    region: region, // Production region (same as bucket)
+                    bucketRef: {
+                        name: bucketName,
+                    },
+                    rule: [
+                        {
+                            id: 'expire-old-blocks',
+                            status: 'Enabled',
+                            expiration: [
+                                {
+                                    days: config.retention.prometheusS31h, // 730 days (2 years) retention
+                                },
+                            ],
+                        },
+                    ],
+                },
+                providerConfigRef: {
+                    name: 'hetzner-s3',
+                },
+            },
+        });
+    }
+}
+exports.ThanosS3BucketConstruct = ThanosS3BucketConstruct;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidGhhbm9zLXMzLWJ1Y2tldC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jb25zdHJ1Y3RzL3RoYW5vcy1zMy1idWNrZXQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsaUNBQWtDO0FBQ2xDLDJDQUF1QztBQUN2QyxvRUFBZ0k7QUFPaEk7Ozs7Ozs7Ozs7Ozs7OztHQWVHO0FBQ0gsTUFBYSx1QkFBd0IsU0FBUSxzQkFBUztJQUNwRCxZQUFZLEtBQWdCLEVBQUUsRUFBVSxFQUFFLEtBQTBCO1FBQ2xFLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFFakIsTUFBTSxFQUFFLE1BQU0sRUFBRSxHQUFHLEtBQUssQ0FBQztRQUN6QixNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsRUFBRSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUM7UUFDNUMsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLEVBQUUsQ0FBQyxNQUFNLENBQUM7UUFFaEMsZ0JBQWdCO1FBQ2hCLHNFQUFzRTtRQUN0RSx1RkFBdUY7UUFDdkYsSUFBSSxpQkFBUyxDQUFDLElBQUksRUFBRSxRQUFRLEVBQUU7WUFDNUIsVUFBVSxFQUFFLDJCQUEyQjtZQUN2QyxJQUFJLEVBQUUsUUFBUTtZQUNkLFFBQVEsRUFBRTtnQkFDUixJQUFJLEVBQUUsVUFBVTtnQkFDaEIsU0FBUyxFQUFFLG1CQUFtQjtnQkFDOUIsTUFBTSxFQUFFO29CQUNOLHdCQUF3QixFQUFFLFFBQVE7b0JBQ2xDLDZCQUE2QixFQUFFLFNBQVM7b0JBQ3hDLDhCQUE4QixFQUFFLE9BQU87b0JBQ3ZDLDJCQUEyQixFQUFFLFlBQVk7aUJBQzFDO2dCQUNELFdBQVcsRUFBRTtvQkFDWCw4QkFBOEIsRUFBRSxHQUFHO29CQUNuQyw2QkFBNkIsRUFBRSxVQUFVO29CQUN6QyxhQUFhLEVBQUUscURBQXFEO2lCQUNyRTthQUNGO1lBQ0QsSUFBSSxFQUFFO2dCQUNKLGNBQWMsRUFBRSxRQUFRO2dCQUN4QixrQkFBa0IsRUFBRTtvQkFDbEIsU0FBUztvQkFDVCxRQUFRO29CQUNSLFFBQVE7b0JBQ1Isd0VBQXdFO2lCQUN6RTtnQkFDRCxXQUFXLEVBQUU7b0JBQ1gsTUFBTSxFQUFFLE1BQU0sRUFBRSwwREFBMEQ7aUJBQzNFO2dCQUNELGlCQUFpQixFQUFFO29CQUNqQixJQUFJLEVBQUUsWUFBWTtpQkFDbkI7YUFDRjtTQUNGLENBQUMsQ0FBQztRQUVILDBCQUEwQjtRQUMxQix3Q0FBd0M7UUFDeEMsaUdBQWlHO1FBQ2pHLElBQUksaUJBQVMsQ0FBQyxJQUFJLEVBQUUsWUFBWSxFQUFFO1lBQ2hDLFVBQVUsRUFBRSwyQkFBMkI7WUFDdkMsSUFBSSxFQUFFLGtCQUFrQjtZQUN4QixRQUFRLEVBQUU7Z0JBQ1IsSUFBSSxFQUFFLDJCQUEyQjtnQkFDakMsU0FBUyxFQUFFLG1CQUFtQjtnQkFDOUIsTUFBTSxFQUFFO29CQUNOLHdCQUF3QixFQUFFLFFBQVE7b0JBQ2xDLDZCQUE2QixFQUFFLFNBQVM7b0JBQ3hDLDhCQUE4QixFQUFFLE9BQU87b0JBQ3ZDLDJCQUEyQixFQUFFLFlBQVk7aUJBQzFDO2dCQUNELFdBQVcsRUFBRTtvQkFDWCw4QkFBOEIsRUFBRSxHQUFHO2lCQUNwQzthQUNGO1lBQ0QsSUFBSSxFQUFFO2dCQUNKLFdBQVcsRUFBRTtvQkFDWCxNQUFNLEVBQUUsTUFBTSxFQUFFLHFDQUFxQztvQkFDckQsU0FBUyxFQUFFO3dCQUNULElBQUksRUFBRSxVQUFVO3FCQUNqQjtvQkFDRCx1QkFBdUIsRUFBRTt3QkFDdkIsTUFBTSxFQUFFLFNBQVM7cUJBQ2xCO2lCQUNGO2dCQUNELGlCQUFpQixFQUFFO29CQUNqQixJQUFJLEVBQUUsWUFBWTtpQkFDbkI7YUFDRjtTQUNGLENBQUMsQ0FBQztRQUVILHNDQUFzQztRQUN0QywyRUFBMkU7UUFDM0UsSUFBSSxnREFBNEIsQ0FBQyxJQUFJLEVBQUUsV0FBVyxFQUFFO1lBQ2xELFFBQVEsRUFBRTtnQkFDUixJQUFJLEVBQUUsMEJBQTBCO2dCQUNoQyxTQUFTLEVBQUUsbUJBQW1CO2dCQUM5QixNQUFNLEVBQUU7b0JBQ04sd0JBQXdCLEVBQUUsUUFBUTtvQkFDbEMsNkJBQTZCLEVBQUUsU0FBUztvQkFDeEMsOEJBQThCLEVBQUUsT0FBTztvQkFDdkMsMkJBQTJCLEVBQUUsWUFBWTtpQkFDMUM7Z0JBQ0QsV0FBVyxFQUFFO29CQUNYLDhCQUE4QixFQUFFLEdBQUc7aUJBQ3BDO2FBQ0Y7WUFDRCxJQUFJLEVBQUU7Z0JBQ0osa0JBQWtCLEVBQUU7b0JBQ2xCLHNFQUFrRCxDQUFDLE9BQU87b0JBQzFELHNFQUFrRCxDQUFDLE1BQU07b0JBQ3pELHNFQUFrRCxDQUFDLE1BQU07aUJBQzFEO2dCQUNELFdBQVcsRUFBRTtvQkFDWCxNQUFNLEVBQUUsTUFBTSxFQUFFLHFDQUFxQztvQkFDckQsU0FBUyxFQUFFO3dCQUNULElBQUksRUFBRSxVQUFVO3FCQUNqQjtvQkFDRCxJQUFJLEVBQUU7d0JBQ0o7NEJBQ0UsRUFBRSxFQUFFLG1CQUFtQjs0QkFDdkIsTUFBTSxFQUFFLFNBQVM7NEJBQ2pCLFVBQVUsRUFBRTtnQ0FDVjtvQ0FDRSxJQUFJLEVBQUUsTUFBTSxDQUFDLFNBQVMsQ0FBQyxjQUFjLEVBQUUsK0JBQStCO2lDQUN2RTs2QkFDRjt5QkFDRjtxQkFDRjtpQkFDRjtnQkFDRCxpQkFBaUIsRUFBRTtvQkFDakIsSUFBSSxFQUFFLFlBQVk7aUJBQ25CO2FBQ0Y7U0FDRixDQUFDLENBQUM7SUFDTCxDQUFDO0NBQ0Y7QUE5SEQsMERBOEhDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgQXBpT2JqZWN0IH0gZnJvbSAnY2RrOHMnO1xuaW1wb3J0IHsgQ29uc3RydWN0IH0gZnJvbSAnY29uc3RydWN0cyc7XG5pbXBvcnQgeyBCdWNrZXRMaWZlY3ljbGVDb25maWd1cmF0aW9uLCBCdWNrZXRMaWZlY3ljbGVDb25maWd1cmF0aW9uU3BlY01hbmFnZW1lbnRQb2xpY2llcyB9IGZyb20gJy4uL2ltcG9ydHMvczMuYXdzLnVwYm91bmQuaW8nO1xuaW1wb3J0IHsgTW9uaXRvcmluZ0NvbmZpZyB9IGZyb20gJy4uL3R5cGVzJztcblxuZXhwb3J0IGludGVyZmFjZSBUaGFub3NTM0J1Y2tldFByb3BzIHtcbiAgY29uZmlnOiBNb25pdG9yaW5nQ29uZmlnO1xufVxuXG4vKipcbiAqIENyZWF0ZXMgQ3Jvc3NwbGFuZSBCdWNrZXQgcmVzb3VyY2VzIGZvciBUaGFub3MgbG9uZy10ZXJtIG1ldHJpY3Mgc3RvcmFnZS5cbiAqXG4gKiBUaGlzIGNvbnN0cnVjdCBnZW5lcmF0ZXM6XG4gKiAtIFMzIEJ1Y2tldCAodmlhIENyb3NzcGxhbmUgVXBib3VuZCBwcm92aWRlci1hd3MtczMpXG4gKiAtIEJ1Y2tldFZlcnNpb25pbmcgKGZvciByZWNvdmVyeSlcbiAqIC0gQnVja2V0TGlmZWN5Y2xlQ29uZmlndXJhdGlvbiAoMi15ZWFyIHJldGVudGlvbilcbiAqXG4gKiBQcmVyZXF1aXNpdGVzOlxuICogLSBDcm9zc3BsYW5lIG9wZXJhdG9yIGluc3RhbGxlZFxuICogLSBVcGJvdW5kIHByb3ZpZGVyLWF3cy1zMyBpbnN0YWxsZWRcbiAqIC0gUHJvdmlkZXJDb25maWcgJ2hldHpuZXItczMnIGNvbmZpZ3VyZWQgKHBvaW50cyB0byBIZXR6bmVyIFMzKVxuICogLSBIZXR6bmVyIFMzIGNyZWRlbnRpYWxzIHNlY3JldCBleGlzdHMgaW4gY3Jvc3NwbGFuZS1zeXN0ZW1cbiAqXG4gKiBTeW5jIFdhdmU6IDEgKGV4dGVybmFsIGRlcGVuZGVuY2llcyAtIG11c3QgZXhpc3QgYmVmb3JlIHBvZHMgYWNjZXNzIFMzKVxuICovXG5leHBvcnQgY2xhc3MgVGhhbm9zUzNCdWNrZXRDb25zdHJ1Y3QgZXh0ZW5kcyBDb25zdHJ1Y3Qge1xuICBjb25zdHJ1Y3RvcihzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nLCBwcm9wczogVGhhbm9zUzNCdWNrZXRQcm9wcykge1xuICAgIHN1cGVyKHNjb3BlLCBpZCk7XG5cbiAgICBjb25zdCB7IGNvbmZpZyB9ID0gcHJvcHM7XG4gICAgY29uc3QgYnVja2V0TmFtZSA9IGNvbmZpZy5zMy5idWNrZXRzLnRoYW5vcztcbiAgICBjb25zdCByZWdpb24gPSBjb25maWcuczMucmVnaW9uO1xuXG4gICAgLy8gQ3JlYXRlIEJ1Y2tldFxuICAgIC8vIFdhdmUgMTogRXh0ZXJuYWwgRGVwZW5kZW5jaWVzIC0gUzMgYnVja2V0IHByb3Zpc2lvbmVkIGJ5IENyb3NzcGxhbmVcbiAgICAvLyBOb3RlOiBVc2luZyBBcGlPYmplY3QgYmVjYXVzZSBjZGs4cyBpbXBvcnQgbGltaXRhdGlvbnMgcHJldmVudCBpbXBvcnRpbmcgQnVja2V0IHR5cGVcbiAgICBuZXcgQXBpT2JqZWN0KHRoaXMsICdidWNrZXQnLCB7XG4gICAgICBhcGlWZXJzaW9uOiAnczMuYXdzLnVwYm91bmQuaW8vdjFiZXRhMicsXG4gICAgICBraW5kOiAnQnVja2V0JyxcbiAgICAgIG1ldGFkYXRhOiB7XG4gICAgICAgIG5hbWU6IGJ1Y2tldE5hbWUsXG4gICAgICAgIG5hbWVzcGFjZTogJ2Nyb3NzcGxhbmUtc3lzdGVtJyxcbiAgICAgICAgbGFiZWxzOiB7XG4gICAgICAgICAgJ2FwcC5rdWJlcm5ldGVzLmlvL25hbWUnOiAndGhhbm9zJyxcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vY29tcG9uZW50JzogJ3N0b3JhZ2UnLFxuICAgICAgICAgICdhcHAua3ViZXJuZXRlcy5pby9tYW5hZ2VkLWJ5JzogJ2NkazhzJyxcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZic6ICdtb25pdG9yaW5nJyxcbiAgICAgICAgfSxcbiAgICAgICAgYW5ub3RhdGlvbnM6IHtcbiAgICAgICAgICAnYXJnb2NkLmFyZ29wcm9qLmlvL3N5bmMtd2F2ZSc6ICcxJyxcbiAgICAgICAgICAnY3Jvc3NwbGFuZS5pby9leHRlcm5hbC1uYW1lJzogYnVja2V0TmFtZSxcbiAgICAgICAgICAnZGVzY3JpcHRpb24nOiAnVGhhbm9zIGxvbmctdGVybSBtZXRyaWNzIHN0b3JhZ2UgKDIteWVhciByZXRlbnRpb24pJyxcbiAgICAgICAgfSxcbiAgICAgIH0sXG4gICAgICBzcGVjOiB7XG4gICAgICAgIGRlbGV0aW9uUG9saWN5OiAnRGVsZXRlJyxcbiAgICAgICAgbWFuYWdlbWVudFBvbGljaWVzOiBbXG4gICAgICAgICAgJ09ic2VydmUnLFxuICAgICAgICAgICdDcmVhdGUnLFxuICAgICAgICAgICdEZWxldGUnLFxuICAgICAgICAgIC8vIFNraXAgVXBkYXRlIHRvIGF2b2lkIHRhZ2dpbmcgb3BlcmF0aW9ucyAobm90IHN1cHBvcnRlZCBieSBIZXR6bmVyIFMzKVxuICAgICAgICBdLFxuICAgICAgICBmb3JQcm92aWRlcjoge1xuICAgICAgICAgIHJlZ2lvbjogcmVnaW9uLCAvLyBQcm9kdWN0aW9uIHJlZ2lvbiAoZW5kcG9pbnQgZGV0ZXJtaW5lcyBhY3R1YWwgbG9jYXRpb24pXG4gICAgICAgIH0sXG4gICAgICAgIHByb3ZpZGVyQ29uZmlnUmVmOiB7XG4gICAgICAgICAgbmFtZTogJ2hldHpuZXItczMnLFxuICAgICAgICB9LFxuICAgICAgfSxcbiAgICB9KTtcblxuICAgIC8vIENyZWF0ZSBCdWNrZXRWZXJzaW9uaW5nXG4gICAgLy8gRW5hYmxlIHZlcnNpb25pbmcgZm9yIGJ1Y2tldCByZWNvdmVyeVxuICAgIC8vIE5vdGU6IFVzaW5nIEFwaU9iamVjdCBiZWNhdXNlIGNkazhzIGltcG9ydCBsaW1pdGF0aW9ucyBwcmV2ZW50IGltcG9ydGluZyBCdWNrZXRWZXJzaW9uaW5nIHR5cGVcbiAgICBuZXcgQXBpT2JqZWN0KHRoaXMsICd2ZXJzaW9uaW5nJywge1xuICAgICAgYXBpVmVyc2lvbjogJ3MzLmF3cy51cGJvdW5kLmlvL3YxYmV0YTInLFxuICAgICAga2luZDogJ0J1Y2tldFZlcnNpb25pbmcnLFxuICAgICAgbWV0YWRhdGE6IHtcbiAgICAgICAgbmFtZTogJ3RoYW5vcy1tZXRyaWNzLXZlcnNpb25pbmcnLFxuICAgICAgICBuYW1lc3BhY2U6ICdjcm9zc3BsYW5lLXN5c3RlbScsXG4gICAgICAgIGxhYmVsczoge1xuICAgICAgICAgICdhcHAua3ViZXJuZXRlcy5pby9uYW1lJzogJ3RoYW5vcycsXG4gICAgICAgICAgJ2FwcC5rdWJlcm5ldGVzLmlvL2NvbXBvbmVudCc6ICdzdG9yYWdlJyxcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vbWFuYWdlZC1ieSc6ICdjZGs4cycsXG4gICAgICAgICAgJ2FwcC5rdWJlcm5ldGVzLmlvL3BhcnQtb2YnOiAnbW9uaXRvcmluZycsXG4gICAgICAgIH0sXG4gICAgICAgIGFubm90YXRpb25zOiB7XG4gICAgICAgICAgJ2FyZ29jZC5hcmdvcHJvai5pby9zeW5jLXdhdmUnOiAnMScsXG4gICAgICAgIH0sXG4gICAgICB9LFxuICAgICAgc3BlYzoge1xuICAgICAgICBmb3JQcm92aWRlcjoge1xuICAgICAgICAgIHJlZ2lvbjogcmVnaW9uLCAvLyBQcm9kdWN0aW9uIHJlZ2lvbiAoc2FtZSBhcyBidWNrZXQpXG4gICAgICAgICAgYnVja2V0UmVmOiB7XG4gICAgICAgICAgICBuYW1lOiBidWNrZXROYW1lLFxuICAgICAgICAgIH0sXG4gICAgICAgICAgdmVyc2lvbmluZ0NvbmZpZ3VyYXRpb246IHtcbiAgICAgICAgICAgIHN0YXR1czogJ0VuYWJsZWQnLFxuICAgICAgICAgIH0sXG4gICAgICAgIH0sXG4gICAgICAgIHByb3ZpZGVyQ29uZmlnUmVmOiB7XG4gICAgICAgICAgbmFtZTogJ2hldHpuZXItczMnLFxuICAgICAgICB9LFxuICAgICAgfSxcbiAgICB9KTtcblxuICAgIC8vIENyZWF0ZSBCdWNrZXRMaWZlY3ljbGVDb25maWd1cmF0aW9uXG4gICAgLy8gTGlmZWN5Y2xlIHBvbGljeTogRGVsZXRlIGRvd25zYW1wbGVkIGJsb2NrcyBhZnRlciAyIHllYXJzIChjb3N0IGNvbnRyb2wpXG4gICAgbmV3IEJ1Y2tldExpZmVjeWNsZUNvbmZpZ3VyYXRpb24odGhpcywgJ2xpZmVjeWNsZScsIHtcbiAgICAgIG1ldGFkYXRhOiB7XG4gICAgICAgIG5hbWU6ICd0aGFub3MtbWV0cmljcy1saWZlY3ljbGUnLFxuICAgICAgICBuYW1lc3BhY2U6ICdjcm9zc3BsYW5lLXN5c3RlbScsXG4gICAgICAgIGxhYmVsczoge1xuICAgICAgICAgICdhcHAua3ViZXJuZXRlcy5pby9uYW1lJzogJ3RoYW5vcycsXG4gICAgICAgICAgJ2FwcC5rdWJlcm5ldGVzLmlvL2NvbXBvbmVudCc6ICdzdG9yYWdlJyxcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vbWFuYWdlZC1ieSc6ICdjZGs4cycsXG4gICAgICAgICAgJ2FwcC5rdWJlcm5ldGVzLmlvL3BhcnQtb2YnOiAnbW9uaXRvcmluZycsXG4gICAgICAgIH0sXG4gICAgICAgIGFubm90YXRpb25zOiB7XG4gICAgICAgICAgJ2FyZ29jZC5hcmdvcHJvai5pby9zeW5jLXdhdmUnOiAnMScsXG4gICAgICAgIH0sXG4gICAgICB9LFxuICAgICAgc3BlYzoge1xuICAgICAgICBtYW5hZ2VtZW50UG9saWNpZXM6IFtcbiAgICAgICAgICBCdWNrZXRMaWZlY3ljbGVDb25maWd1cmF0aW9uU3BlY01hbmFnZW1lbnRQb2xpY2llcy5PQlNFUlZFLFxuICAgICAgICAgIEJ1Y2tldExpZmVjeWNsZUNvbmZpZ3VyYXRpb25TcGVjTWFuYWdlbWVudFBvbGljaWVzLkNSRUFURSxcbiAgICAgICAgICBCdWNrZXRMaWZlY3ljbGVDb25maWd1cmF0aW9uU3BlY01hbmFnZW1lbnRQb2xpY2llcy5ERUxFVEUsXG4gICAgICAgIF0sXG4gICAgICAgIGZvclByb3ZpZGVyOiB7XG4gICAgICAgICAgcmVnaW9uOiByZWdpb24sIC8vIFByb2R1Y3Rpb24gcmVnaW9uIChzYW1lIGFzIGJ1Y2tldClcbiAgICAgICAgICBidWNrZXRSZWY6IHtcbiAgICAgICAgICAgIG5hbWU6IGJ1Y2tldE5hbWUsXG4gICAgICAgICAgfSxcbiAgICAgICAgICBydWxlOiBbXG4gICAgICAgICAgICB7XG4gICAgICAgICAgICAgIGlkOiAnZXhwaXJlLW9sZC1ibG9ja3MnLFxuICAgICAgICAgICAgICBzdGF0dXM6ICdFbmFibGVkJyxcbiAgICAgICAgICAgICAgZXhwaXJhdGlvbjogW1xuICAgICAgICAgICAgICAgIHtcbiAgICAgICAgICAgICAgICAgIGRheXM6IGNvbmZpZy5yZXRlbnRpb24ucHJvbWV0aGV1c1MzMWgsIC8vIDczMCBkYXlzICgyIHllYXJzKSByZXRlbnRpb25cbiAgICAgICAgICAgICAgICB9LFxuICAgICAgICAgICAgICBdLFxuICAgICAgICAgICAgfSxcbiAgICAgICAgICBdLFxuICAgICAgICB9LFxuICAgICAgICBwcm92aWRlckNvbmZpZ1JlZjoge1xuICAgICAgICAgIG5hbWU6ICdoZXR6bmVyLXMzJyxcbiAgICAgICAgfSxcbiAgICAgIH0sXG4gICAgfSk7XG4gIH1cbn1cbiJdfQ==

package/lib/constructs/thanos-s3-credentials.d.ts

@@ -0,0 +1,27 @@
+import { Construct } from 'constructs';
+import { MonitoringConfig } from '../types';
+export interface ThanosS3CredentialsProps {
+    namespace: string;
+    config: MonitoringConfig;
+}
+/**
+ * Creates ExternalSecret for Thanos S3 credentials.
+ *
+ * This construct replicates Hetzner S3 credentials from crossplane-system
+ * namespace to monitoring namespace and transforms them into Thanos objstore.yml format.
+ *
+ * Prerequisites:
+ * - External Secrets Operator installed
+ * - ClusterSecretStore 'hetzner-s3-cluster-store' exists (points to crossplane-system)
+ * - Secret 'hetzner-s3-creds-standard' exists in crossplane-system namespace
+ *
+ * Generated Secret:
+ * - Name: thanos-objstore-config
+ * - Key: objstore.yml
+ * - Format: Thanos object storage configuration YAML
+ *
+ * Sync Wave: 1 (external dependencies - must exist before Thanos components start)
+ */
+export declare class ThanosS3CredentialsConstruct extends Construct {
+    constructor(scope: Construct, id: string, props: ThanosS3CredentialsProps);
+}

package/lib/constructs/thanos-s3-credentials.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ThanosS3CredentialsConstruct = void 0;
+const constructs_1 = require("constructs");
+const external_secrets_io_1 = require("../imports/external-secrets.io");
+/**
+ * Creates ExternalSecret for Thanos S3 credentials.
+ *
+ * This construct replicates Hetzner S3 credentials from crossplane-system
+ * namespace to monitoring namespace and transforms them into Thanos objstore.yml format.
+ *
+ * Prerequisites:
+ * - External Secrets Operator installed
+ * - ClusterSecretStore 'hetzner-s3-cluster-store' exists (points to crossplane-system)
+ * - Secret 'hetzner-s3-creds-standard' exists in crossplane-system namespace
+ *
+ * Generated Secret:
+ * - Name: thanos-objstore-config
+ * - Key: objstore.yml
+ * - Format: Thanos object storage configuration YAML
+ *
+ * Sync Wave: 1 (external dependencies - must exist before Thanos components start)
+ */
+class ThanosS3CredentialsConstruct extends constructs_1.Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        const { namespace, config } = props;
+        // Create ExternalSecret that replicates S3 credentials
+        // Wave 1: External Dependencies - credentials must exist before Thanos components
+        new external_secrets_io_1.ExternalSecret(this, 'thanos-s3-external-secret', {
+            metadata: {
+                name: 'thanos-s3-credentials-es',
+                namespace: namespace,
+                labels: {
+                    'app.kubernetes.io/name': 'thanos',
+                    'app.kubernetes.io/component': 'objstore-config',
+                    'app.kubernetes.io/managed-by': 'cdk8s',
+                    'app.kubernetes.io/part-of': 'monitoring',
+                },
+                annotations: {
+                    'argocd.argoproj.io/sync-wave': '1',
+                },
+            },
+            spec: {
+                // Refresh credentials every hour (automatic rotation support)
+                refreshInterval: '1h',
+                // Use existing ClusterSecretStore for Hetzner S3 (infrastructure-level secrets)
+                secretStoreRef: {
+                    name: 'hetzner-s3-cluster-store',
+                    kind: external_secrets_io_1.ExternalSecretSpecSecretStoreRefKind.CLUSTER_SECRET_STORE,
+                },
+                // Target secret that Thanos sidecar will consume
+                target: {
+                    name: 'thanos-objstore-config',
+                    creationPolicy: external_secrets_io_1.ExternalSecretSpecTargetCreationPolicy.OWNER,
+                    // Transform AWS credential format into Thanos objstore.yml
+                    template: {
+                        engineVersion: external_secrets_io_1.ExternalSecretSpecTargetTemplateEngineVersion.V2,
+                        data: {
+                            'objstore.yml': `type: S3
+config:
+  bucket: "${config.s3.buckets.thanos}"
+  endpoint: "${config.s3.endpointNoProtocol}"
+  region: ${config.s3.region}
+  access_key: {{ .AWS_ACCESS_KEY_ID }}
+  secret_key: {{ .AWS_SECRET_ACCESS_KEY }}
+  insecure: false
+  signature_version2: false
+  http_config:
+    idle_conn_timeout: 90s
+    response_header_timeout: 2m
+    insecure_skip_verify: false
+  trace:
+    enable: false
+  part_size: 67108864  # 64MB upload chunks
+`,
+                        },
+                    },
+                },
+                // Fetch S3 credentials from crossplane-system/hetzner-s3-creds-standard
+                dataFrom: [
+                    {
+                        extract: {
+                            key: 'hetzner-s3-creds-standard',
+                        },
+                    },
+                ],
+            },
+        });
+    }
+}
+exports.ThanosS3CredentialsConstruct = ThanosS3CredentialsConstruct;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidGhhbm9zLXMzLWNyZWRlbnRpYWxzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2NvbnN0cnVjdHMvdGhhbm9zLXMzLWNyZWRlbnRpYWxzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLDJDQUF1QztBQUN2Qyx3RUFLd0M7QUFReEM7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBaUJHO0FBQ0gsTUFBYSw0QkFBNkIsU0FBUSxzQkFBUztJQUN6RCxZQUFZLEtBQWdCLEVBQUUsRUFBVSxFQUFFLEtBQStCO1FBQ3ZFLEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFFakIsTUFBTSxFQUFFLFNBQVMsRUFBRSxNQUFNLEVBQUUsR0FBRyxLQUFLLENBQUM7UUFFcEMsdURBQXVEO1FBQ3ZELGtGQUFrRjtRQUNsRixJQUFJLG9DQUFjLENBQUMsSUFBSSxFQUFFLDJCQUEyQixFQUFFO1lBQ3BELFFBQVEsRUFBRTtnQkFDUixJQUFJLEVBQUUsMEJBQTBCO2dCQUNoQyxTQUFTLEVBQUUsU0FBUztnQkFDcEIsTUFBTSxFQUFFO29CQUNOLHdCQUF3QixFQUFFLFFBQVE7b0JBQ2xDLDZCQUE2QixFQUFFLGlCQUFpQjtvQkFDaEQsOEJBQThCLEVBQUUsT0FBTztvQkFDdkMsMkJBQTJCLEVBQUUsWUFBWTtpQkFDMUM7Z0JBQ0QsV0FBVyxFQUFFO29CQUNYLDhCQUE4QixFQUFFLEdBQUc7aUJBQ3BDO2FBQ0Y7WUFDRCxJQUFJLEVBQUU7Z0JBQ0osOERBQThEO2dCQUM5RCxlQUFlLEVBQUUsSUFBSTtnQkFFckIsZ0ZBQWdGO2dCQUNoRixjQUFjLEVBQUU7b0JBQ2QsSUFBSSxFQUFFLDBCQUEwQjtvQkFDaEMsSUFBSSxFQUFFLDBEQUFvQyxDQUFDLG9CQUFvQjtpQkFDaEU7Z0JBRUQsaURBQWlEO2dCQUNqRCxNQUFNLEVBQUU7b0JBQ04sSUFBSSxFQUFFLHdCQUF3QjtvQkFDOUIsY0FBYyxFQUFFLDREQUFzQyxDQUFDLEtBQUs7b0JBRTVELDJEQUEyRDtvQkFDM0QsUUFBUSxFQUFFO3dCQUNSLGFBQWEsRUFBRSxtRUFBNkMsQ0FBQyxFQUFFO3dCQUMvRCxJQUFJLEVBQUU7NEJBQ0osY0FBYyxFQUFFOzthQUVqQixNQUFNLENBQUMsRUFBRSxDQUFDLE9BQU8sQ0FBQyxNQUFNO2VBQ3RCLE1BQU0sQ0FBQyxFQUFFLENBQUMsa0JBQWtCO1lBQy9CLE1BQU0sQ0FBQyxFQUFFLENBQUMsTUFBTTs7Ozs7Ozs7Ozs7O0NBWTNCO3lCQUNZO3FCQUNGO2lCQUNGO2dCQUVELHdFQUF3RTtnQkFDeEUsUUFBUSxFQUFFO29CQUNSO3dCQUNFLE9BQU8sRUFBRTs0QkFDUCxHQUFHLEVBQUUsMkJBQTJCO3lCQUNqQztxQkFDRjtpQkFDRjthQUNGO1NBQ0YsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztDQUNGO0FBekVELG9FQXlFQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gJ2NvbnN0cnVjdHMnO1xuaW1wb3J0IHtcbiAgRXh0ZXJuYWxTZWNyZXQsXG4gIEV4dGVybmFsU2VjcmV0U3BlY1RhcmdldENyZWF0aW9uUG9saWN5LFxuICBFeHRlcm5hbFNlY3JldFNwZWNUYXJnZXRUZW1wbGF0ZUVuZ2luZVZlcnNpb24sXG4gIEV4dGVybmFsU2VjcmV0U3BlY1NlY3JldFN0b3JlUmVmS2luZCxcbn0gZnJvbSAnLi4vaW1wb3J0cy9leHRlcm5hbC1zZWNyZXRzLmlvJztcbmltcG9ydCB7IE1vbml0b3JpbmdDb25maWcgfSBmcm9tICcuLi90eXBlcyc7XG5cbmV4cG9ydCBpbnRlcmZhY2UgVGhhbm9zUzNDcmVkZW50aWFsc1Byb3BzIHtcbiAgbmFtZXNwYWNlOiBzdHJpbmc7XG4gIGNvbmZpZzogTW9uaXRvcmluZ0NvbmZpZztcbn1cblxuLyoqXG4gKiBDcmVhdGVzIEV4dGVybmFsU2VjcmV0IGZvciBUaGFub3MgUzMgY3JlZGVudGlhbHMuXG4gKlxuICogVGhpcyBjb25zdHJ1Y3QgcmVwbGljYXRlcyBIZXR6bmVyIFMzIGNyZWRlbnRpYWxzIGZyb20gY3Jvc3NwbGFuZS1zeXN0ZW1cbiAqIG5hbWVzcGFjZSB0byBtb25pdG9yaW5nIG5hbWVzcGFjZSBhbmQgdHJhbnNmb3JtcyB0aGVtIGludG8gVGhhbm9zIG9ianN0b3JlLnltbCBmb3JtYXQuXG4gKlxuICogUHJlcmVxdWlzaXRlczpcbiAqIC0gRXh0ZXJuYWwgU2VjcmV0cyBPcGVyYXRvciBpbnN0YWxsZWRcbiAqIC0gQ2x1c3RlclNlY3JldFN0b3JlICdoZXR6bmVyLXMzLWNsdXN0ZXItc3RvcmUnIGV4aXN0cyAocG9pbnRzIHRvIGNyb3NzcGxhbmUtc3lzdGVtKVxuICogLSBTZWNyZXQgJ2hldHpuZXItczMtY3JlZHMtc3RhbmRhcmQnIGV4aXN0cyBpbiBjcm9zc3BsYW5lLXN5c3RlbSBuYW1lc3BhY2VcbiAqXG4gKiBHZW5lcmF0ZWQgU2VjcmV0OlxuICogLSBOYW1lOiB0aGFub3Mtb2Jqc3RvcmUtY29uZmlnXG4gKiAtIEtleTogb2Jqc3RvcmUueW1sXG4gKiAtIEZvcm1hdDogVGhhbm9zIG9iamVjdCBzdG9yYWdlIGNvbmZpZ3VyYXRpb24gWUFNTFxuICpcbiAqIFN5bmMgV2F2ZTogMSAoZXh0ZXJuYWwgZGVwZW5kZW5jaWVzIC0gbXVzdCBleGlzdCBiZWZvcmUgVGhhbm9zIGNvbXBvbmVudHMgc3RhcnQpXG4gKi9cbmV4cG9ydCBjbGFzcyBUaGFub3NTM0NyZWRlbnRpYWxzQ29uc3RydWN0IGV4dGVuZHMgQ29uc3RydWN0IHtcbiAgY29uc3RydWN0b3Ioc2NvcGU6IENvbnN0cnVjdCwgaWQ6IHN0cmluZywgcHJvcHM6IFRoYW5vc1MzQ3JlZGVudGlhbHNQcm9wcykge1xuICAgIHN1cGVyKHNjb3BlLCBpZCk7XG5cbiAgICBjb25zdCB7IG5hbWVzcGFjZSwgY29uZmlnIH0gPSBwcm9wcztcblxuICAgIC8vIENyZWF0ZSBFeHRlcm5hbFNlY3JldCB0aGF0IHJlcGxpY2F0ZXMgUzMgY3JlZGVudGlhbHNcbiAgICAvLyBXYXZlIDE6IEV4dGVybmFsIERlcGVuZGVuY2llcyAtIGNyZWRlbnRpYWxzIG11c3QgZXhpc3QgYmVmb3JlIFRoYW5vcyBjb21wb25lbnRzXG4gICAgbmV3IEV4dGVybmFsU2VjcmV0KHRoaXMsICd0aGFub3MtczMtZXh0ZXJuYWwtc2VjcmV0Jywge1xuICAgICAgbWV0YWRhdGE6IHtcbiAgICAgICAgbmFtZTogJ3RoYW5vcy1zMy1jcmVkZW50aWFscy1lcycsXG4gICAgICAgIG5hbWVzcGFjZTogbmFtZXNwYWNlLFxuICAgICAgICBsYWJlbHM6IHtcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vbmFtZSc6ICd0aGFub3MnLFxuICAgICAgICAgICdhcHAua3ViZXJuZXRlcy5pby9jb21wb25lbnQnOiAnb2Jqc3RvcmUtY29uZmlnJyxcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vbWFuYWdlZC1ieSc6ICdjZGs4cycsXG4gICAgICAgICAgJ2FwcC5rdWJlcm5ldGVzLmlvL3BhcnQtb2YnOiAnbW9uaXRvcmluZycsXG4gICAgICAgIH0sXG4gICAgICAgIGFubm90YXRpb25zOiB7XG4gICAgICAgICAgJ2FyZ29jZC5hcmdvcHJvai5pby9zeW5jLXdhdmUnOiAnMScsXG4gICAgICAgIH0sXG4gICAgICB9LFxuICAgICAgc3BlYzoge1xuICAgICAgICAvLyBSZWZyZXNoIGNyZWRlbnRpYWxzIGV2ZXJ5IGhvdXIgKGF1dG9tYXRpYyByb3RhdGlvbiBzdXBwb3J0KVxuICAgICAgICByZWZyZXNoSW50ZXJ2YWw6ICcxaCcsXG5cbiAgICAgICAgLy8gVXNlIGV4aXN0aW5nIENsdXN0ZXJTZWNyZXRTdG9yZSBmb3IgSGV0em5lciBTMyAoaW5mcmFzdHJ1Y3R1cmUtbGV2ZWwgc2VjcmV0cylcbiAgICAgICAgc2VjcmV0U3RvcmVSZWY6IHtcbiAgICAgICAgICBuYW1lOiAnaGV0em5lci1zMy1jbHVzdGVyLXN0b3JlJyxcbiAgICAgICAgICBraW5kOiBFeHRlcm5hbFNlY3JldFNwZWNTZWNyZXRTdG9yZVJlZktpbmQuQ0xVU1RFUl9TRUNSRVRfU1RPUkUsXG4gICAgICAgIH0sXG5cbiAgICAgICAgLy8gVGFyZ2V0IHNlY3JldCB0aGF0IFRoYW5vcyBzaWRlY2FyIHdpbGwgY29uc3VtZVxuICAgICAgICB0YXJnZXQ6IHtcbiAgICAgICAgICBuYW1lOiAndGhhbm9zLW9ianN0b3JlLWNvbmZpZycsXG4gICAgICAgICAgY3JlYXRpb25Qb2xpY3k6IEV4dGVybmFsU2VjcmV0U3BlY1RhcmdldENyZWF0aW9uUG9saWN5Lk9XTkVSLFxuXG4gICAgICAgICAgLy8gVHJhbnNmb3JtIEFXUyBjcmVkZW50aWFsIGZvcm1hdCBpbnRvIFRoYW5vcyBvYmpzdG9yZS55bWxcbiAgICAgICAgICB0ZW1wbGF0ZToge1xuICAgICAgICAgICAgZW5naW5lVmVyc2lvbjogRXh0ZXJuYWxTZWNyZXRTcGVjVGFyZ2V0VGVtcGxhdGVFbmdpbmVWZXJzaW9uLlYyLFxuICAgICAgICAgICAgZGF0YToge1xuICAgICAgICAgICAgICAnb2Jqc3RvcmUueW1sJzogYHR5cGU6IFMzXG5jb25maWc6XG4gIGJ1Y2tldDogXCIke2NvbmZpZy5zMy5idWNrZXRzLnRoYW5vc31cIlxuICBlbmRwb2ludDogXCIke2NvbmZpZy5zMy5lbmRwb2ludE5vUHJvdG9jb2x9XCJcbiAgcmVnaW9uOiAke2NvbmZpZy5zMy5yZWdpb259XG4gIGFjY2Vzc19rZXk6IHt7IC5BV1NfQUNDRVNTX0tFWV9JRCB9fVxuICBzZWNyZXRfa2V5OiB7eyAuQVdTX1NFQ1JFVF9BQ0NFU1NfS0VZIH19XG4gIGluc2VjdXJlOiBmYWxzZVxuICBzaWduYXR1cmVfdmVyc2lvbjI6IGZhbHNlXG4gIGh0dHBfY29uZmlnOlxuICAgIGlkbGVfY29ubl90aW1lb3V0OiA5MHNcbiAgICByZXNwb25zZV9oZWFkZXJfdGltZW91dDogMm1cbiAgICBpbnNlY3VyZV9za2lwX3ZlcmlmeTogZmFsc2VcbiAgdHJhY2U6XG4gICAgZW5hYmxlOiBmYWxzZVxuICBwYXJ0X3NpemU6IDY3MTA4ODY0ICAjIDY0TUIgdXBsb2FkIGNodW5rc1xuYCxcbiAgICAgICAgICAgIH0sXG4gICAgICAgICAgfSxcbiAgICAgICAgfSxcblxuICAgICAgICAvLyBGZXRjaCBTMyBjcmVkZW50aWFscyBmcm9tIGNyb3NzcGxhbmUtc3lzdGVtL2hldHpuZXItczMtY3JlZHMtc3RhbmRhcmRcbiAgICAgICAgZGF0YUZyb206IFtcbiAgICAgICAgICB7XG4gICAgICAgICAgICBleHRyYWN0OiB7XG4gICAgICAgICAgICAgIGtleTogJ2hldHpuZXItczMtY3JlZHMtc3RhbmRhcmQnLFxuICAgICAgICAgICAgfSxcbiAgICAgICAgICB9LFxuICAgICAgICBdLFxuICAgICAgfSxcbiAgICB9KTtcbiAgfVxufVxuIl19

package/lib/constructs/thanos-store.d.ts

@@ -0,0 +1,30 @@
+import { Construct } from 'constructs';
+import { MonitoringConfig } from '../types';
+export interface ThanosStoreProps {
+    namespace: string;
+    config: MonitoringConfig;
+}
+/**
+ * Creates Thanos Store Gateway StatefulSet and Services.
+ *
+ * Thanos Store Gateway queries historical data from S3 and makes it
+ * available via gRPC to Thanos Query. This enables transparent querying
+ * of metrics older than the Prometheus local retention (>3 days).
+ *
+ * Components:
+ * - StatefulSet (2 replicas with anti-affinity, 10Gi PVC each for index cache)
+ * - gRPC Service (headless, for Thanos Query discovery)
+ * - HTTP Service (for debugging and metrics)
+ *
+ * Prerequisites:
+ * - Namespace exists
+ * - PriorityClass 'high-priority' exists
+ * - Longhorn storage class available
+ * - Thanos S3 secret exists (thanos-objstore-config)
+ * - S3 bucket contains Prometheus data blocks
+ *
+ * Sync Wave: 3 (storage gateway - after S3 bucket and credentials)
+ */
+export declare class ThanosStoreConstruct extends Construct {
+    constructor(scope: Construct, id: string, props: ThanosStoreProps);
+}

package/lib/constructs/thanos-store.js

@@ -0,0 +1,239 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ThanosStoreConstruct = void 0;
+const constructs_1 = require("constructs");
+const k8s_1 = require("../imports/k8s");
+/**
+ * Creates Thanos Store Gateway StatefulSet and Services.
+ *
+ * Thanos Store Gateway queries historical data from S3 and makes it
+ * available via gRPC to Thanos Query. This enables transparent querying
+ * of metrics older than the Prometheus local retention (>3 days).
+ *
+ * Components:
+ * - StatefulSet (2 replicas with anti-affinity, 10Gi PVC each for index cache)
+ * - gRPC Service (headless, for Thanos Query discovery)
+ * - HTTP Service (for debugging and metrics)
+ *
+ * Prerequisites:
+ * - Namespace exists
+ * - PriorityClass 'high-priority' exists
+ * - Longhorn storage class available
+ * - Thanos S3 secret exists (thanos-objstore-config)
+ * - S3 bucket contains Prometheus data blocks
+ *
+ * Sync Wave: 3 (storage gateway - after S3 bucket and credentials)
+ */
+class ThanosStoreConstruct extends constructs_1.Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        const { namespace, config } = props;
+        // Create StatefulSet
+        // Wave 3: Storage Gateway - after S3 bucket and credentials are ready
+        new k8s_1.KubeStatefulSet(this, 'statefulset', {
+            metadata: {
+                name: 'thanos-store',
+                namespace: namespace,
+                labels: {
+                    'app.kubernetes.io/name': 'thanos-store',
+                    'app.kubernetes.io/component': 'store-gateway',
+                    'app.kubernetes.io/managed-by': 'cdk8s',
+                    'app.kubernetes.io/part-of': 'monitoring',
+                },
+                annotations: {
+                    'argocd.argoproj.io/sync-wave': '3',
+                },
+            },
+            spec: {
+                serviceName: 'thanos-store',
+                replicas: config.replicas.thanosStore,
+                selector: {
+                    matchLabels: {
+                        'app.kubernetes.io/name': 'thanos-store',
+                    },
+                },
+                template: {
+                    metadata: {
+                        labels: {
+                            'app.kubernetes.io/name': 'thanos-store',
+                            'app.kubernetes.io/component': 'store-gateway',
+                        },
+                    },
+                    spec: {
+                        // No arch nodeSelector: Thanos images are multi-arch; let the
+                        // scheduler place these on any worker (the ARM64 pin was a legacy
+                        // placement onto the cax31 agent pool, now being retired → EX).
+                        // Spread replicas across different nodes for HA
+                        affinity: {
+                            podAntiAffinity: {
+                                preferredDuringSchedulingIgnoredDuringExecution: [
+                                    {
+                                        weight: 100,
+                                        podAffinityTerm: {
+                                            labelSelector: {
+                                                matchLabels: {
+                                                    'app.kubernetes.io/name': 'thanos-store',
+                                                },
+                                            },
+                                            topologyKey: 'kubernetes.io/hostname',
+                                        },
+                                    },
+                                ],
+                            },
+                        },
+                        // Fix volume permissions for Thanos user (UID 10001)
+                        securityContext: {
+                            fsGroup: 10001,
+                            runAsUser: 10001,
+                            runAsNonRoot: true,
+                        },
+                        containers: [
+                            {
+                                name: 'thanos-store',
+                                image: `quay.io/thanos/thanos:${config.versions.thanos}`,
+                                args: [
+                                    'store',
+                                    '--log.level=info',
+                                    '--data-dir=/var/thanos/store',
+                                    '--objstore.config-file=/etc/thanos/objstore.yml',
+                                    '--index-cache-size=500MB',
+                                    '--chunk-pool-size=500MB',
+                                ],
+                                ports: [
+                                    {
+                                        name: 'http',
+                                        containerPort: 10902,
+                                    },
+                                    {
+                                        name: 'grpc',
+                                        containerPort: 10901,
+                                    },
+                                ],
+                                volumeMounts: [
+                                    {
+                                        name: 'objstore-config',
+                                        mountPath: '/etc/thanos',
+                                        readOnly: true,
+                                    },
+                                    {
+                                        name: 'data',
+                                        mountPath: '/var/thanos/store',
+                                    },
+                                ],
+                                livenessProbe: {
+                                    httpGet: {
+                                        path: '/-/healthy',
+                                        port: k8s_1.IntOrString.fromString('http'),
+                                    },
+                                    initialDelaySeconds: 30,
+                                    periodSeconds: 30,
+                                },
+                                readinessProbe: {
+                                    httpGet: {
+                                        path: '/-/ready',
+                                        port: k8s_1.IntOrString.fromString('http'),
+                                    },
+                                    initialDelaySeconds: 30,
+                                    periodSeconds: 5,
+                                },
+                                resources: {
+                                    requests: {
+                                        cpu: k8s_1.Quantity.fromString(config.resources.thanosStore.requests.cpu),
+                                        memory: k8s_1.Quantity.fromString(config.resources.thanosStore.requests.memory),
+                                    },
+                                    limits: {
+                                        cpu: k8s_1.Quantity.fromString(config.resources.thanosStore.limits.cpu),
+                                        memory: k8s_1.Quantity.fromString(config.resources.thanosStore.limits.memory),
+                                    },
+                                },
+                            },
+                        ],
+                        volumes: [
+                            {
+                                name: 'objstore-config',
+                                secret: {
+                                    secretName: 'thanos-objstore-config',
+                                },
+                            },
+                        ],
+                        priorityClassName: 'high-priority',
+                    },
+                },
+                volumeClaimTemplates: [
+                    {
+                        metadata: {
+                            name: 'data',
+                        },
+                        spec: {
+                            accessModes: ['ReadWriteOnce'],
+                            storageClassName: 'longhorn',
+                            resources: {
+                                requests: {
+                                    storage: k8s_1.Quantity.fromString(config.storage.thanosStore), // Cache for S3 index data
+                                },
+                            },
+                        },
+                    },
+                ],
+            },
+        });
+        // Create gRPC Service (headless, for Thanos Query to discover)
+        new k8s_1.KubeService(this, 'service-grpc', {
+            metadata: {
+                name: 'thanos-store-grpc',
+                namespace: namespace,
+                labels: {
+                    'app.kubernetes.io/name': 'thanos-store',
+                    'app.kubernetes.io/managed-by': 'cdk8s',
+                },
+                annotations: {
+                    'argocd.argoproj.io/sync-wave': '3',
+                },
+            },
+            spec: {
+                type: 'ClusterIP',
+                clusterIp: 'None', // Headless service for DNS-based discovery
+                ports: [
+                    {
+                        name: 'grpc',
+                        port: 10901,
+                        targetPort: 'grpc',
+                        protocol: 'TCP',
+                    },
+                ],
+                selector: {
+                    'app.kubernetes.io/name': 'thanos-store',
+                },
+            },
+        });
+        // Create HTTP Service (for debugging/metrics)
+        new k8s_1.KubeService(this, 'service-http', {
+            metadata: {
+                name: 'thanos-store-http',
+                namespace: namespace,
+                labels: {
+                    'app.kubernetes.io/name': 'thanos-store',
+                    'app.kubernetes.io/managed-by': 'cdk8s',
+                },
+                annotations: {
+                    'argocd.argoproj.io/sync-wave': '3',
+                },
+            },
+            spec: {
+                ports: [
+                    {
+                        name: 'http',
+                        port: 10902,
+                        targetPort: 'http',
+                        protocol: 'TCP',
+                    },
+                ],
+                selector: {
+                    'app.kubernetes.io/name': 'thanos-store',
+                },
+            },
+        });
+    }
+}
+exports.ThanosStoreConstruct = ThanosStoreConstruct;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidGhhbm9zLXN0b3JlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2NvbnN0cnVjdHMvdGhhbm9zLXN0b3JlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLDJDQUF1QztBQUN2Qyx3Q0FBcUY7QUFRckY7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBb0JHO0FBQ0gsTUFBYSxvQkFBcUIsU0FBUSxzQkFBUztJQUNqRCxZQUFZLEtBQWdCLEVBQUUsRUFBVSxFQUFFLEtBQXVCO1FBQy9ELEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFFakIsTUFBTSxFQUFFLFNBQVMsRUFBRSxNQUFNLEVBQUUsR0FBRyxLQUFLLENBQUM7UUFFcEMscUJBQXFCO1FBQ3JCLHNFQUFzRTtRQUN0RSxJQUFJLHFCQUFlLENBQUMsSUFBSSxFQUFFLGFBQWEsRUFBRTtZQUN2QyxRQUFRLEVBQUU7Z0JBQ1IsSUFBSSxFQUFFLGNBQWM7Z0JBQ3BCLFNBQVMsRUFBRSxTQUFTO2dCQUNwQixNQUFNLEVBQUU7b0JBQ04sd0JBQXdCLEVBQUUsY0FBYztvQkFDeEMsNkJBQTZCLEVBQUUsZUFBZTtvQkFDOUMsOEJBQThCLEVBQUUsT0FBTztvQkFDdkMsMkJBQTJCLEVBQUUsWUFBWTtpQkFDMUM7Z0JBQ0QsV0FBVyxFQUFFO29CQUNYLDhCQUE4QixFQUFFLEdBQUc7aUJBQ3BDO2FBQ0Y7WUFDRCxJQUFJLEVBQUU7Z0JBQ0osV0FBVyxFQUFFLGNBQWM7Z0JBQzNCLFFBQVEsRUFBRSxNQUFNLENBQUMsUUFBUSxDQUFDLFdBQVc7Z0JBQ3JDLFFBQVEsRUFBRTtvQkFDUixXQUFXLEVBQUU7d0JBQ1gsd0JBQXdCLEVBQUUsY0FBYztxQkFDekM7aUJBQ0Y7Z0JBQ0QsUUFBUSxFQUFFO29CQUNSLFFBQVEsRUFBRTt3QkFDUixNQUFNLEVBQUU7NEJBQ04sd0JBQXdCLEVBQUUsY0FBYzs0QkFDeEMsNkJBQTZCLEVBQUUsZUFBZTt5QkFDL0M7cUJBQ0Y7b0JBQ0QsSUFBSSxFQUFFO3dCQUNKLDhEQUE4RDt3QkFDOUQsa0VBQWtFO3dCQUNsRSxnRUFBZ0U7d0JBRWhFLGdEQUFnRDt3QkFDaEQsUUFBUSxFQUFFOzRCQUNSLGVBQWUsRUFBRTtnQ0FDZiwrQ0FBK0MsRUFBRTtvQ0FDL0M7d0NBQ0UsTUFBTSxFQUFFLEdBQUc7d0NBQ1gsZUFBZSxFQUFFOzRDQUNmLGFBQWEsRUFBRTtnREFDYixXQUFXLEVBQUU7b0RBQ1gsd0JBQXdCLEVBQUUsY0FBYztpREFDekM7NkNBQ0Y7NENBQ0QsV0FBVyxFQUFFLHdCQUF3Qjt5Q0FDdEM7cUNBQ0Y7aUNBQ0Y7NkJBQ0Y7eUJBQ0Y7d0JBRUQscURBQXFEO3dCQUNyRCxlQUFlLEVBQUU7NEJBQ2YsT0FBTyxFQUFFLEtBQUs7NEJBQ2QsU0FBUyxFQUFFLEtBQUs7NEJBQ2hCLFlBQVksRUFBRSxJQUFJO3lCQUNuQjt3QkFFRCxVQUFVLEVBQUU7NEJBQ1Y7Z0NBQ0UsSUFBSSxFQUFFLGNBQWM7Z0NBQ3BCLEtBQUssRUFBRSx5QkFBeUIsTUFBTSxDQUFDLFFBQVEsQ0FBQyxNQUFNLEVBQUU7Z0NBQ3hELElBQUksRUFBRTtvQ0FDSixPQUFPO29DQUNQLGtCQUFrQjtvQ0FDbEIsOEJBQThCO29DQUM5QixpREFBaUQ7b0NBQ2pELDBCQUEwQjtvQ0FDMUIseUJBQXlCO2lDQUMxQjtnQ0FDRCxLQUFLLEVBQUU7b0NBQ0w7d0NBQ0UsSUFBSSxFQUFFLE1BQU07d0NBQ1osYUFBYSxFQUFFLEtBQUs7cUNBQ3JCO29DQUNEO3dDQUNFLElBQUksRUFBRSxNQUFNO3dDQUNaLGFBQWEsRUFBRSxLQUFLO3FDQUNyQjtpQ0FDRjtnQ0FDRCxZQUFZLEVBQUU7b0NBQ1o7d0NBQ0UsSUFBSSxFQUFFLGlCQUFpQjt3Q0FDdkIsU0FBUyxFQUFFLGFBQWE7d0NBQ3hCLFFBQVEsRUFBRSxJQUFJO3FDQUNmO29DQUNEO3dDQUNFLElBQUksRUFBRSxNQUFNO3dDQUNaLFNBQVMsRUFBRSxtQkFBbUI7cUNBQy9CO2lDQUNGO2dDQUNELGFBQWEsRUFBRTtvQ0FDYixPQUFPLEVBQUU7d0NBQ1AsSUFBSSxFQUFFLFlBQVk7d0NBQ2xCLElBQUksRUFBRSxpQkFBVyxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUM7cUNBQ3JDO29DQUNELG1CQUFtQixFQUFFLEVBQUU7b0NBQ3ZCLGFBQWEsRUFBRSxFQUFFO2lDQUNsQjtnQ0FDRCxjQUFjLEVBQUU7b0NBQ2QsT0FBTyxFQUFFO3dDQUNQLElBQUksRUFBRSxVQUFVO3dDQUNoQixJQUFJLEVBQUUsaUJBQVcsQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDO3FDQUNyQztvQ0FDRCxtQkFBbUIsRUFBRSxFQUFFO29DQUN2QixhQUFhLEVBQUUsQ0FBQztpQ0FDakI7Z0NBQ0QsU0FBUyxFQUFFO29DQUNULFFBQVEsRUFBRTt3Q0FDUixHQUFHLEVBQUUsY0FBUSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLFdBQVcsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDO3dDQUNuRSxNQUFNLEVBQUUsY0FBUSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLFdBQVcsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDO3FDQUMxRTtvQ0FDRCxNQUFNLEVBQUU7d0NBQ04sR0FBRyxFQUFFLGNBQVEsQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxXQUFXLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQzt3Q0FDakUsTUFBTSxFQUFFLGNBQVEsQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxXQUFXLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQztxQ0FDeEU7aUNBQ0Y7NkJBQ0Y7eUJBQ0Y7d0JBRUQsT0FBTyxFQUFFOzRCQUNQO2dDQUNFLElBQUksRUFBRSxpQkFBaUI7Z0NBQ3ZCLE1BQU0sRUFBRTtvQ0FDTixVQUFVLEVBQUUsd0JBQXdCO2lDQUNyQzs2QkFDRjt5QkFDRjt3QkFFRCxpQkFBaUIsRUFBRSxlQUFlO3FCQUNuQztpQkFDRjtnQkFDRCxvQkFBb0IsRUFBRTtvQkFDcEI7d0JBQ0UsUUFBUSxFQUFFOzRCQUNSLElBQUksRUFBRSxNQUFNO3lCQUNiO3dCQUNELElBQUksRUFBRTs0QkFDSixXQUFXLEVBQUUsQ0FBQyxlQUFlLENBQUM7NEJBQzlCLGdCQUFnQixFQUFFLFVBQVU7NEJBQzVCLFNBQVMsRUFBRTtnQ0FDVCxRQUFRLEVBQUU7b0NBQ1IsT0FBTyxFQUFFLGNBQVEsQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsRUFBRSwwQkFBMEI7aUNBQ3JGOzZCQUNGO3lCQUNGO3FCQUNGO2lCQUNGO2FBQ0Y7U0FDRixDQUFDLENBQUM7UUFFSCwrREFBK0Q7UUFDL0QsSUFBSSxpQkFBVyxDQUFDLElBQUksRUFBRSxjQUFjLEVBQUU7WUFDcEMsUUFBUSxFQUFFO2dCQUNSLElBQUksRUFBRSxtQkFBbUI7Z0JBQ3pCLFNBQVMsRUFBRSxTQUFTO2dCQUNwQixNQUFNLEVBQUU7b0JBQ04sd0JBQXdCLEVBQUUsY0FBYztvQkFDeEMsOEJBQThCLEVBQUUsT0FBTztpQkFDeEM7Z0JBQ0QsV0FBVyxFQUFFO29CQUNYLDhCQUE4QixFQUFFLEdBQUc7aUJBQ3BDO2FBQ0Y7WUFDRCxJQUFJLEVBQUU7Z0JBQ0osSUFBSSxFQUFFLFdBQVc7Z0JBQ2pCLFNBQVMsRUFBRSxNQUFNLEVBQUUsMkNBQTJDO2dCQUM5RCxLQUFLLEVBQUU7b0JBQ0w7d0JBQ0UsSUFBSSxFQUFFLE1BQU07d0JBQ1osSUFBSSxFQUFFLEtBQUs7d0JBQ1gsVUFBVSxFQUFFLE1BQWE7d0JBQ3pCLFFBQVEsRUFBRSxLQUFLO3FCQUNoQjtpQkFDRjtnQkFDRCxRQUFRLEVBQUU7b0JBQ1Isd0JBQXdCLEVBQUUsY0FBYztpQkFDekM7YUFDRjtTQUNGLENBQUMsQ0FBQztRQUVILDhDQUE4QztRQUM5QyxJQUFJLGlCQUFXLENBQUMsSUFBSSxFQUFFLGNBQWMsRUFBRTtZQUNwQyxRQUFRLEVBQUU7Z0JBQ1IsSUFBSSxFQUFFLG1CQUFtQjtnQkFDekIsU0FBUyxFQUFFLFNBQVM7Z0JBQ3BCLE1BQU0sRUFBRTtvQkFDTix3QkFBd0IsRUFBRSxjQUFjO29CQUN4Qyw4QkFBOEIsRUFBRSxPQUFPO2lCQUN4QztnQkFDRCxXQUFXLEVBQUU7b0JBQ1gsOEJBQThCLEVBQUUsR0FBRztpQkFDcEM7YUFDRjtZQUNELElBQUksRUFBRTtnQkFDSixLQUFLLEVBQUU7b0JBQ0w7d0JBQ0UsSUFBSSxFQUFFLE1BQU07d0JBQ1osSUFBSSxFQUFFLEtBQUs7d0JBQ1gsVUFBVSxFQUFFLE1BQWE7d0JBQ3pCLFFBQVEsRUFBRSxLQUFLO3FCQUNoQjtpQkFDRjtnQkFDRCxRQUFRLEVBQUU7b0JBQ1Isd0JBQXdCLEVBQUUsY0FBYztpQkFDekM7YUFDRjtTQUNGLENBQUMsQ0FBQztJQUNMLENBQUM7Q0FDRjtBQTNORCxvREEyTkMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBDb25zdHJ1Y3QgfSBmcm9tICdjb25zdHJ1Y3RzJztcbmltcG9ydCB7IEt1YmVTdGF0ZWZ1bFNldCwgS3ViZVNlcnZpY2UsIFF1YW50aXR5LCBJbnRPclN0cmluZyB9IGZyb20gJy4uL2ltcG9ydHMvazhzJztcbmltcG9ydCB7IE1vbml0b3JpbmdDb25maWcgfSBmcm9tICcuLi90eXBlcyc7XG5cbmV4cG9ydCBpbnRlcmZhY2UgVGhhbm9zU3RvcmVQcm9wcyB7XG4gIG5hbWVzcGFjZTogc3RyaW5nO1xuICBjb25maWc6IE1vbml0b3JpbmdDb25maWc7XG59XG5cbi8qKlxuICogQ3JlYXRlcyBUaGFub3MgU3RvcmUgR2F0ZXdheSBTdGF0ZWZ1bFNldCBhbmQgU2VydmljZXMuXG4gKlxuICogVGhhbm9zIFN0b3JlIEdhdGV3YXkgcXVlcmllcyBoaXN0b3JpY2FsIGRhdGEgZnJvbSBTMyBhbmQgbWFrZXMgaXRcbiAqIGF2YWlsYWJsZSB2aWEgZ1JQQyB0byBUaGFub3MgUXVlcnkuIFRoaXMgZW5hYmxlcyB0cmFuc3BhcmVudCBxdWVyeWluZ1xuICogb2YgbWV0cmljcyBvbGRlciB0aGFuIHRoZSBQcm9tZXRoZXVzIGxvY2FsIHJldGVudGlvbiAoPjMgZGF5cykuXG4gKlxuICogQ29tcG9uZW50czpcbiAqIC0gU3RhdGVmdWxTZXQgKDIgcmVwbGljYXMgd2l0aCBhbnRpLWFmZmluaXR5LCAxMEdpIFBWQyBlYWNoIGZvciBpbmRleCBjYWNoZSlcbiAqIC0gZ1JQQyBTZXJ2aWNlIChoZWFkbGVzcywgZm9yIFRoYW5vcyBRdWVyeSBkaXNjb3ZlcnkpXG4gKiAtIEhUVFAgU2VydmljZSAoZm9yIGRlYnVnZ2luZyBhbmQgbWV0cmljcylcbiAqXG4gKiBQcmVyZXF1aXNpdGVzOlxuICogLSBOYW1lc3BhY2UgZXhpc3RzXG4gKiAtIFByaW9yaXR5Q2xhc3MgJ2hpZ2gtcHJpb3JpdHknIGV4aXN0c1xuICogLSBMb25naG9ybiBzdG9yYWdlIGNsYXNzIGF2YWlsYWJsZVxuICogLSBUaGFub3MgUzMgc2VjcmV0IGV4aXN0cyAodGhhbm9zLW9ianN0b3JlLWNvbmZpZylcbiAqIC0gUzMgYnVja2V0IGNvbnRhaW5zIFByb21ldGhldXMgZGF0YSBibG9ja3NcbiAqXG4gKiBTeW5jIFdhdmU6IDMgKHN0b3JhZ2UgZ2F0ZXdheSAtIGFmdGVyIFMzIGJ1Y2tldCBhbmQgY3JlZGVudGlhbHMpXG4gKi9cbmV4cG9ydCBjbGFzcyBUaGFub3NTdG9yZUNvbnN0cnVjdCBleHRlbmRzIENvbnN0cnVjdCB7XG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzOiBUaGFub3NTdG9yZVByb3BzKSB7XG4gICAgc3VwZXIoc2NvcGUsIGlkKTtcblxuICAgIGNvbnN0IHsgbmFtZXNwYWNlLCBjb25maWcgfSA9IHByb3BzO1xuXG4gICAgLy8gQ3JlYXRlIFN0YXRlZnVsU2V0XG4gICAgLy8gV2F2ZSAzOiBTdG9yYWdlIEdhdGV3YXkgLSBhZnRlciBTMyBidWNrZXQgYW5kIGNyZWRlbnRpYWxzIGFyZSByZWFkeVxuICAgIG5ldyBLdWJlU3RhdGVmdWxTZXQodGhpcywgJ3N0YXRlZnVsc2V0Jywge1xuICAgICAgbWV0YWRhdGE6IHtcbiAgICAgICAgbmFtZTogJ3RoYW5vcy1zdG9yZScsXG4gICAgICAgIG5hbWVzcGFjZTogbmFtZXNwYWNlLFxuICAgICAgICBsYWJlbHM6IHtcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vbmFtZSc6ICd0aGFub3Mtc3RvcmUnLFxuICAgICAgICAgICdhcHAua3ViZXJuZXRlcy5pby9jb21wb25lbnQnOiAnc3RvcmUtZ2F0ZXdheScsXG4gICAgICAgICAgJ2FwcC5rdWJlcm5ldGVzLmlvL21hbmFnZWQtYnknOiAnY2RrOHMnLFxuICAgICAgICAgICdhcHAua3ViZXJuZXRlcy5pby9wYXJ0LW9mJzogJ21vbml0b3JpbmcnLFxuICAgICAgICB9LFxuICAgICAgICBhbm5vdGF0aW9uczoge1xuICAgICAgICAgICdhcmdvY2QuYXJnb3Byb2ouaW8vc3luYy13YXZlJzogJzMnLFxuICAgICAgICB9LFxuICAgICAgfSxcbiAgICAgIHNwZWM6IHtcbiAgICAgICAgc2VydmljZU5hbWU6ICd0aGFub3Mtc3RvcmUnLFxuICAgICAgICByZXBsaWNhczogY29uZmlnLnJlcGxpY2FzLnRoYW5vc1N0b3JlLFxuICAgICAgICBzZWxlY3Rvcjoge1xuICAgICAgICAgIG1hdGNoTGFiZWxzOiB7XG4gICAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vbmFtZSc6ICd0aGFub3Mtc3RvcmUnLFxuICAgICAgICAgIH0sXG4gICAgICAgIH0sXG4gICAgICAgIHRlbXBsYXRlOiB7XG4gICAgICAgICAgbWV0YWRhdGE6IHtcbiAgICAgICAgICAgIGxhYmVsczoge1xuICAgICAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vbmFtZSc6ICd0aGFub3Mtc3RvcmUnLFxuICAgICAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vY29tcG9uZW50JzogJ3N0b3JlLWdhdGV3YXknLFxuICAgICAgICAgICAgfSxcbiAgICAgICAgICB9LFxuICAgICAgICAgIHNwZWM6IHtcbiAgICAgICAgICAgIC8vIE5vIGFyY2ggbm9kZVNlbGVjdG9yOiBUaGFub3MgaW1hZ2VzIGFyZSBtdWx0aS1hcmNoOyBsZXQgdGhlXG4gICAgICAgICAgICAvLyBzY2hlZHVsZXIgcGxhY2UgdGhlc2Ugb24gYW55IHdvcmtlciAodGhlIEFSTTY0IHBpbiB3YXMgYSBsZWdhY3lcbiAgICAgICAgICAgIC8vIHBsYWNlbWVudCBvbnRvIHRoZSBjYXgzMSBhZ2VudCBwb29sLCBub3cgYmVpbmcgcmV0aXJlZCDihpIgRVgpLlxuXG4gICAgICAgICAgICAvLyBTcHJlYWQgcmVwbGljYXMgYWNyb3NzIGRpZmZlcmVudCBub2RlcyBmb3IgSEFcbiAgICAgICAgICAgIGFmZmluaXR5OiB7XG4gICAgICAgICAgICAgIHBvZEFudGlBZmZpbml0eToge1xuICAgICAgICAgICAgICAgIHByZWZlcnJlZER1cmluZ1NjaGVkdWxpbmdJZ25vcmVkRHVyaW5nRXhlY3V0aW9uOiBbXG4gICAgICAgICAgICAgICAgICB7XG4gICAgICAgICAgICAgICAgICAgIHdlaWdodDogMTAwLFxuICAgICAgICAgICAgICAgICAgICBwb2RBZmZpbml0eVRlcm06IHtcbiAgICAgICAgICAgICAgICAgICAgICBsYWJlbFNlbGVjdG9yOiB7XG4gICAgICAgICAgICAgICAgICAgICAgICBtYXRjaExhYmVsczoge1xuICAgICAgICAgICAgICAgICAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vbmFtZSc6ICd0aGFub3Mtc3RvcmUnLFxuICAgICAgICAgICAgICAgICAgICAgICAgfSxcbiAgICAgICAgICAgICAgICAgICAgICB9LFxuICAgICAgICAgICAgICAgICAgICAgIHRvcG9sb2d5S2V5OiAna3ViZXJuZXRlcy5pby9ob3N0bmFtZScsXG4gICAgICAgICAgICAgICAgICAgIH0sXG4gICAgICAgICAgICAgICAgICB9LFxuICAgICAgICAgICAgICAgIF0sXG4gICAgICAgICAgICAgIH0sXG4gICAgICAgICAgICB9LFxuXG4gICAgICAgICAgICAvLyBGaXggdm9sdW1lIHBlcm1pc3Npb25zIGZvciBUaGFub3MgdXNlciAoVUlEIDEwMDAxKVxuICAgICAgICAgICAgc2VjdXJpdHlDb250ZXh0OiB7XG4gICAgICAgICAgICAgIGZzR3JvdXA6IDEwMDAxLFxuICAgICAgICAgICAgICBydW5Bc1VzZXI6IDEwMDAxLFxuICAgICAgICAgICAgICBydW5Bc05vblJvb3Q6IHRydWUsXG4gICAgICAgICAgICB9LFxuXG4gICAgICAgICAgICBjb250YWluZXJzOiBbXG4gICAgICAgICAgICAgIHtcbiAgICAgICAgICAgICAgICBuYW1lOiAndGhhbm9zLXN0b3JlJyxcbiAgICAgICAgICAgICAgICBpbWFnZTogYHF1YXkuaW8vdGhhbm9zL3RoYW5vczoke2NvbmZpZy52ZXJzaW9ucy50aGFub3N9YCxcbiAgICAgICAgICAgICAgICBhcmdzOiBbXG4gICAgICAgICAgICAgICAgICAnc3RvcmUnLFxuICAgICAgICAgICAgICAgICAgJy0tbG9nLmxldmVsPWluZm8nLFxuICAgICAgICAgICAgICAgICAgJy0tZGF0YS1kaXI9L3Zhci90aGFub3Mvc3RvcmUnLFxuICAgICAgICAgICAgICAgICAgJy0tb2Jqc3RvcmUuY29uZmlnLWZpbGU9L2V0Yy90aGFub3Mvb2Jqc3RvcmUueW1sJyxcbiAgICAgICAgICAgICAgICAgICctLWluZGV4LWNhY2hlLXNpemU9NTAwTUInLFxuICAgICAgICAgICAgICAgICAgJy0tY2h1bmstcG9vbC1zaXplPTUwME1CJyxcbiAgICAgICAgICAgICAgICBdLFxuICAgICAgICAgICAgICAgIHBvcnRzOiBbXG4gICAgICAgICAgICAgICAgICB7XG4gICAgICAgICAgICAgICAgICAgIG5hbWU6ICdodHRwJyxcbiAgICAgICAgICAgICAgICAgICAgY29udGFpbmVyUG9ydDogMTA5MDIsXG4gICAgICAgICAgICAgICAgICB9LFxuICAgICAgICAgICAgICAgICAge1xuICAgICAgICAgICAgICAgICAgICBuYW1lOiAnZ3JwYycsXG4gICAgICAgICAgICAgICAgICAgIGNvbnRhaW5lclBvcnQ6IDEwOTAxLFxuICAgICAgICAgICAgICAgICAgfSxcbiAgICAgICAgICAgICAgICBdLFxuICAgICAgICAgICAgICAgIHZvbHVtZU1vdW50czogW1xuICAgICAgICAgICAgICAgICAge1xuICAgICAgICAgICAgICAgICAgICBuYW1lOiAnb2Jqc3RvcmUtY29uZmlnJyxcbiAgICAgICAgICAgICAgICAgICAgbW91bnRQYXRoOiAnL2V0Yy90aGFub3MnLFxuICAgICAgICAgICAgICAgICAgICByZWFkT25seTogdHJ1ZSxcbiAgICAgICAgICAgICAgICAgIH0sXG4gICAgICAgICAgICAgICAgICB7XG4gICAgICAgICAgICAgICAgICAgIG5hbWU6ICdkYXRhJyxcbiAgICAgICAgICAgICAgICAgICAgbW91bnRQYXRoOiAnL3Zhci90aGFub3Mvc3RvcmUnLFxuICAgICAgICAgICAgICAgICAgfSxcbiAgICAgICAgICAgICAgICBdLFxuICAgICAgICAgICAgICAgIGxpdmVuZXNzUHJvYmU6IHtcbiAgICAgICAgICAgICAgICAgIGh0dHBHZXQ6IHtcbiAgICAgICAgICAgICAgICAgICAgcGF0aDogJy8tL2hlYWx0aHknLFxuICAgICAgICAgICAgICAgICAgICBwb3J0OiBJbnRPclN0cmluZy5mcm9tU3RyaW5nKCdodHRwJyksXG4gICAgICAgICAgICAgICAgICB9LFxuICAgICAgICAgICAgICAgICAgaW5pdGlhbERlbGF5U2Vjb25kczogMzAsXG4gICAgICAgICAgICAgICAgICBwZXJpb2RTZWNvbmRzOiAzMCxcbiAgICAgICAgICAgICAgICB9LFxuICAgICAgICAgICAgICAgIHJlYWRpbmVzc1Byb2JlOiB7XG4gICAgICAgICAgICAgICAgICBodHRwR2V0OiB7XG4gICAgICAgICAgICAgICAgICAgIHBhdGg6ICcvLS9yZWFkeScsXG4gICAgICAgICAgICAgICAgICAgIHBvcnQ6IEludE9yU3RyaW5nLmZyb21TdHJpbmcoJ2h0dHAnKSxcbiAgICAgICAgICAgICAgICAgIH0sXG4gICAgICAgICAgICAgICAgICBpbml0aWFsRGVsYXlTZWNvbmRzOiAzMCxcbiAgICAgICAgICAgICAgICAgIHBlcmlvZFNlY29uZHM6IDUsXG4gICAgICAgICAgICAgICAgfSxcbiAgICAgICAgICAgICAgICByZXNvdXJjZXM6IHtcbiAgICAgICAgICAgICAgICAgIHJlcXVlc3RzOiB7XG4gICAgICAgICAgICAgICAgICAgIGNwdTogUXVhbnRpdHkuZnJvbVN0cmluZyhjb25maWcucmVzb3VyY2VzLnRoYW5vc1N0b3JlLnJlcXVlc3RzLmNwdSksXG4gICAgICAgICAgICAgICAgICAgIG1lbW9yeTogUXVhbnRpdHkuZnJvbVN0cmluZyhjb25maWcucmVzb3VyY2VzLnRoYW5vc1N0b3JlLnJlcXVlc3RzLm1lbW9yeSksXG4gICAgICAgICAgICAgICAgICB9LFxuICAgICAgICAgICAgICAgICAgbGltaXRzOiB7XG4gICAgICAgICAgICAgICAgICAgIGNwdTogUXVhbnRpdHkuZnJvbVN0cmluZyhjb25maWcucmVzb3VyY2VzLnRoYW5vc1N0b3JlLmxpbWl0cy5jcHUpLFxuICAgICAgICAgICAgICAgICAgICBtZW1vcnk6IFF1YW50aXR5LmZyb21TdHJpbmcoY29uZmlnLnJlc291cmNlcy50aGFub3NTdG9yZS5saW1pdHMubWVtb3J5KSxcbiAgICAgICAgICAgICAgICAgIH0sXG4gICAgICAgICAgICAgICAgfSxcbiAgICAgICAgICAgICAgfSxcbiAgICAgICAgICAgIF0sXG5cbiAgICAgICAgICAgIHZvbHVtZXM6IFtcbiAgICAgICAgICAgICAge1xuICAgICAgICAgICAgICAgIG5hbWU6ICdvYmpzdG9yZS1jb25maWcnLFxuICAgICAgICAgICAgICAgIHNlY3JldDoge1xuICAgICAgICAgICAgICAgICAgc2VjcmV0TmFtZTogJ3RoYW5vcy1vYmpzdG9yZS1jb25maWcnLFxuICAgICAgICAgICAgICAgIH0sXG4gICAgICAgICAgICAgIH0sXG4gICAgICAgICAgICBdLFxuXG4gICAgICAgICAgICBwcmlvcml0eUNsYXNzTmFtZTogJ2hpZ2gtcHJpb3JpdHknLFxuICAgICAgICAgIH0sXG4gICAgICAgIH0sXG4gICAgICAgIHZvbHVtZUNsYWltVGVtcGxhdGVzOiBbXG4gICAgICAgICAge1xuICAgICAgICAgICAgbWV0YWRhdGE6IHtcbiAgICAgICAgICAgICAgbmFtZTogJ2RhdGEnLFxuICAgICAgICAgICAgfSxcbiAgICAgICAgICAgIHNwZWM6IHtcbiAgICAgICAgICAgICAgYWNjZXNzTW9kZXM6IFsnUmVhZFdyaXRlT25jZSddLFxuICAgICAgICAgICAgICBzdG9yYWdlQ2xhc3NOYW1lOiAnbG9uZ2hvcm4nLFxuICAgICAgICAgICAgICByZXNvdXJjZXM6IHtcbiAgICAgICAgICAgICAgICByZXF1ZXN0czoge1xuICAgICAgICAgICAgICAgICAgc3RvcmFnZTogUXVhbnRpdHkuZnJvbVN0cmluZyhjb25maWcuc3RvcmFnZS50aGFub3NTdG9yZSksIC8vIENhY2hlIGZvciBTMyBpbmRleCBkYXRhXG4gICAgICAgICAgICAgICAgfSxcbiAgICAgICAgICAgICAgfSxcbiAgICAgICAgICAgIH0sXG4gICAgICAgICAgfSxcbiAgICAgICAgXSxcbiAgICAgIH0sXG4gICAgfSk7XG5cbiAgICAvLyBDcmVhdGUgZ1JQQyBTZXJ2aWNlIChoZWFkbGVzcywgZm9yIFRoYW5vcyBRdWVyeSB0byBkaXNjb3ZlcilcbiAgICBuZXcgS3ViZVNlcnZpY2UodGhpcywgJ3NlcnZpY2UtZ3JwYycsIHtcbiAgICAgIG1ldGFkYXRhOiB7XG4gICAgICAgIG5hbWU6ICd0aGFub3Mtc3RvcmUtZ3JwYycsXG4gICAgICAgIG5hbWVzcGFjZTogbmFtZXNwYWNlLFxuICAgICAgICBsYWJlbHM6IHtcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vbmFtZSc6ICd0aGFub3Mtc3RvcmUnLFxuICAgICAgICAgICdhcHAua3ViZXJuZXRlcy5pby9tYW5hZ2VkLWJ5JzogJ2NkazhzJyxcbiAgICAgICAgfSxcbiAgICAgICAgYW5ub3RhdGlvbnM6IHtcbiAgICAgICAgICAnYXJnb2NkLmFyZ29wcm9qLmlvL3N5bmMtd2F2ZSc6ICczJyxcbiAgICAgICAgfSxcbiAgICAgIH0sXG4gICAgICBzcGVjOiB7XG4gICAgICAgIHR5cGU6ICdDbHVzdGVySVAnLFxuICAgICAgICBjbHVzdGVySXA6ICdOb25lJywgLy8gSGVhZGxlc3Mgc2VydmljZSBmb3IgRE5TLWJhc2VkIGRpc2NvdmVyeVxuICAgICAgICBwb3J0czogW1xuICAgICAgICAgIHtcbiAgICAgICAgICAgIG5hbWU6ICdncnBjJyxcbiAgICAgICAgICAgIHBvcnQ6IDEwOTAxLFxuICAgICAgICAgICAgdGFyZ2V0UG9ydDogJ2dycGMnIGFzIGFueSxcbiAgICAgICAgICAgIHByb3RvY29sOiAnVENQJyxcbiAgICAgICAgICB9LFxuICAgICAgICBdLFxuICAgICAgICBzZWxlY3Rvcjoge1xuICAgICAgICAgICdhcHAua3ViZXJuZXRlcy5pby9uYW1lJzogJ3RoYW5vcy1zdG9yZScsXG4gICAgICAgIH0sXG4gICAgICB9LFxuICAgIH0pO1xuXG4gICAgLy8gQ3JlYXRlIEhUVFAgU2VydmljZSAoZm9yIGRlYnVnZ2luZy9tZXRyaWNzKVxuICAgIG5ldyBLdWJlU2VydmljZSh0aGlzLCAnc2VydmljZS1odHRwJywge1xuICAgICAgbWV0YWRhdGE6IHtcbiAgICAgICAgbmFtZTogJ3RoYW5vcy1zdG9yZS1odHRwJyxcbiAgICAgICAgbmFtZXNwYWNlOiBuYW1lc3BhY2UsXG4gICAgICAgIGxhYmVsczoge1xuICAgICAgICAgICdhcHAua3ViZXJuZXRlcy5pby9uYW1lJzogJ3RoYW5vcy1zdG9yZScsXG4gICAgICAgICAgJ2FwcC5rdWJlcm5ldGVzLmlvL21hbmFnZWQtYnknOiAnY2RrOHMnLFxuICAgICAgICB9LFxuICAgICAgICBhbm5vdGF0aW9uczoge1xuICAgICAgICAgICdhcmdvY2QuYXJnb3Byb2ouaW8vc3luYy13YXZlJzogJzMnLFxuICAgICAgICB9LFxuICAgICAgfSxcbiAgICAgIHNwZWM6IHtcbiAgICAgICAgcG9ydHM6IFtcbiAgICAgICAgICB7XG4gICAgICAgICAgICBuYW1lOiAnaHR0cCcsXG4gICAgICAgICAgICBwb3J0OiAxMDkwMixcbiAgICAgICAgICAgIHRhcmdldFBvcnQ6ICdodHRwJyBhcyBhbnksXG4gICAgICAgICAgICBwcm90b2NvbDogJ1RDUCcsXG4gICAgICAgICAgfSxcbiAgICAgICAgXSxcbiAgICAgICAgc2VsZWN0b3I6IHtcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vbmFtZSc6ICd0aGFub3Mtc3RvcmUnLFxuICAgICAgICB9LFxuICAgICAgfSxcbiAgICB9KTtcbiAgfVxufVxuIl19

package/lib/default-config.d.ts

@@ -0,0 +1,12 @@
+import { DefaultableConfig, MonitoringConfig, MonitoringConfigInput } from './types';
+/**
+ * Package-shipped defaults for everything that has a sensible universal value.
+ * Values mirror the kup6s production config at the time of extraction; integration
+ * charts override only what they need via {@link mergeConfig}.
+ */
+export declare const DEFAULT_CONFIG: DefaultableConfig;
+/**
+ * Resolve a full MonitoringConfig by deep-merging the caller's overrides over
+ * DEFAULT_CONFIG. Required cluster values are passed through verbatim.
+ */
+export declare function mergeConfig(input: MonitoringConfigInput): MonitoringConfig;