HYPERFLEET-1363 - feat: add Grafana dashboard provisioning to Helm chart

charts/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: hyperfleet-api
 description: HyperFleet API - Cluster Lifecycle Management Service
 type: application
-version: 1.1.0
+version: 1.2.0
 appVersion: "0.0.0-dev"
 maintainers:
   - name: HyperFleet Team

charts/README.md

@@ -1,6 +1,6 @@
 # hyperfleet-api
 
-![Version: 1.1.0](https://img.shields.io/badge/Version-1.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.0.0-dev](https://img.shields.io/badge/AppVersion-0.0.0--dev-informational?style=flat-square)
+![Version: 1.2.0](https://img.shields.io/badge/Version-1.2.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.0.0-dev](https://img.shields.io/badge/AppVersion-0.0.0--dev-informational?style=flat-square)
 
 HyperFleet API - Cluster Lifecycle Management Service
 
@@ -149,7 +149,7 @@ helm install hyperfleet-api oci://REGISTRY/hyperfleet-api \
 | database.postgresql.persistence.enabled | bool | `false` | Enable persistent storage (uses emptyDir when disabled) |
 | database.postgresql.persistence.size | string | `"1Gi"` | Volume size |
 | database.postgresql.persistence.storageClass | string | `""` | StorageClass name (empty for cluster default) |
-| monitoring | object | `{"podMonitoring":{"additionalLabels":{},"enabled":false,"interval":"30s","metricRelabeling":[],"tlsConfig":{"insecureSkipVerify":false}},"prometheusRule":{"additionalLabels":{},"enabled":false,"namespace":"","rules":{"reconciliationStuck":{"for":"5m","runbookUrl":""},"reconciliationTimeout":{"durationSeconds":1800,"for":"5m","runbookUrl":""}}}}` | Monitoring and alerting configuration |
+| monitoring | object | `{"dashboard":{"enabled":false},"podMonitoring":{"additionalLabels":{},"enabled":false,"interval":"30s","metricRelabeling":[],"tlsConfig":{"insecureSkipVerify":false}},"prometheusRule":{"additionalLabels":{},"enabled":false,"namespace":"","rules":{"reconciliationStuck":{"for":"5m","runbookUrl":""},"reconciliationTimeout":{"durationSeconds":1800,"for":"5m","runbookUrl":""}}},"serviceMonitor":{"enabled":false,"honorLabels":true,"interval":"30s","labels":{},"metricRelabeling":[],"namespace":"","namespaceSelector":{},"scrapeTimeout":"10s"},"tracing":{"enabled":false,"otlpEndpoint":"","otlpProtocol":"grpc","propagators":"tracecontext,baggage","sampler":"parentbased_always_on","samplerArg":"","serviceName":"hyperfleet-api"}}` | Monitoring and alerting configuration |
 | monitoring.podMonitoring | object | `{"additionalLabels":{},"enabled":false,"interval":"30s","metricRelabeling":[],"tlsConfig":{"insecureSkipVerify":false}}` | PodMonitoring for Google Managed Prometheus (GMP) scraping |
 | monitoring.podMonitoring.enabled | bool | `false` | Create a PodMonitoring resource |
 | monitoring.podMonitoring.interval | string | `"30s"` | Scrape interval |
@@ -169,20 +169,25 @@ helm install hyperfleet-api oci://REGISTRY/hyperfleet-api \
 | monitoring.prometheusRule.rules.reconciliationTimeout.durationSeconds | int | `1800` | Stuck duration in seconds that triggers the critical alert |
 | monitoring.prometheusRule.rules.reconciliationTimeout.for | string | `"5m"` | Stabilization window before firing (short — the duration check is the real gate) |
 | monitoring.prometheusRule.rules.reconciliationTimeout.runbookUrl | string | `""` | Runbook URL included in the alert |
-| serviceMonitor | object | `{"enabled":false,"interval":"30s","labels":{},"namespace":"","scrapeTimeout":"10s"}` | ServiceMonitor for Prometheus Operator scrape configuration |
-| serviceMonitor.enabled | bool | `false` | Create a ServiceMonitor resource |
-| serviceMonitor.interval | string | `"30s"` | Scrape interval |
-| serviceMonitor.scrapeTimeout | string | `"10s"` | Scrape timeout |
-| serviceMonitor.labels | object | `{}` | Additional labels for ServiceMonitor discovery |
-| serviceMonitor.namespace | string | `""` | Namespace to create the ServiceMonitor in (defaults to release namespace) |
-| tracing | object | `{"enabled":false,"otlpEndpoint":"","otlpProtocol":"grpc","propagators":"tracecontext,baggage","sampler":"parentbased_traceidratio","samplerArg":"1.0","serviceName":"hyperfleet-api"}` | Distributed tracing configuration (OpenTelemetry) |
-| tracing.enabled | bool | `false` | Enable trace export |
-| tracing.serviceName | string | `"hyperfleet-api"` | Service name reported in traces |
-| tracing.otlpEndpoint | string | `""` | OTLP exporter endpoint (traces go to stdout when empty) |
-| tracing.otlpProtocol | string | `"grpc"` | OTLP protocol (`grpc` or `http/protobuf`) |
-| tracing.sampler | string | `"parentbased_traceidratio"` | Sampler type |
-| tracing.samplerArg | string | `"1.0"` | Sampling rate (`1.0` for dev, `0.01` for production) |
-| tracing.propagators | string | `"tracecontext,baggage"` | Context propagation formats |
+| monitoring.serviceMonitor | object | `{"enabled":false,"honorLabels":true,"interval":"30s","labels":{},"metricRelabeling":[],"namespace":"","namespaceSelector":{},"scrapeTimeout":"10s"}` | ServiceMonitor for Prometheus Operator scrape configuration |
+| monitoring.serviceMonitor.enabled | bool | `false` | Create a ServiceMonitor resource |
+| monitoring.serviceMonitor.interval | string | `"30s"` | Scrape interval |
+| monitoring.serviceMonitor.scrapeTimeout | string | `"10s"` | Scrape timeout (must be less than interval) |
+| monitoring.serviceMonitor.labels | object | `{}` | Additional labels for ServiceMonitor discovery |
+| monitoring.serviceMonitor.honorLabels | bool | `true` | Honor labels from the target to avoid overwriting |
+| monitoring.serviceMonitor.metricRelabeling | list | `[]` | Metric relabel configs applied before ingestion |
+| monitoring.serviceMonitor.namespaceSelector | object | `{}` | Namespace selector for cross-namespace monitoring |
+| monitoring.serviceMonitor.namespace | string | `""` | Namespace to create the ServiceMonitor in (defaults to release namespace) |
+| monitoring.dashboard | object | `{"enabled":false}` | Grafana dashboard provisioning via sidecar ConfigMap |
+| monitoring.dashboard.enabled | bool | `false` | Create a ConfigMap with the Grafana dashboard JSON |
+| monitoring.tracing | object | `{"enabled":false,"otlpEndpoint":"","otlpProtocol":"grpc","propagators":"tracecontext,baggage","sampler":"parentbased_always_on","samplerArg":"","serviceName":"hyperfleet-api"}` | Distributed tracing configuration (OpenTelemetry) |
+| monitoring.tracing.enabled | bool | `false` | Enable trace export |
+| monitoring.tracing.serviceName | string | `"hyperfleet-api"` | Service name reported in traces |
+| monitoring.tracing.otlpEndpoint | string | `""` | OTLP exporter endpoint (traces go to stdout when empty) |
+| monitoring.tracing.otlpProtocol | string | `"grpc"` | OTLP protocol (`grpc` or `http/protobuf`) |
+| monitoring.tracing.sampler | string | `"parentbased_always_on"` | Sampler type |
+| monitoring.tracing.samplerArg | string | `""` | Sampling rate (only used with ratio-based samplers) |
+| monitoring.tracing.propagators | string | `"tracecontext,baggage"` | Context propagation formats |
 | nativeSidecars | list | `[]` | Native sidecar containers (Kubernetes 1.28+). Native sidecars are init containers with `restartPolicy: Always` — they start before other init containers and keep running throughout the pod lifecycle. Use this for database proxies that must be available during `db-migrate`. Each entry is a full Kubernetes container spec. |
 | sidecars | list | `[]` | Regular sidecar containers. These start after init containers complete. Use `nativeSidecars` above for containers that must be available during init (e.g. database proxies). Each entry is a full Kubernetes container spec. |
 | validationSchema | object | `{"content":"","enabled":false,"existingConfigMap":""}` | Validation schema configuration. Supply a custom OpenAPI schema for resource spec validation. When enabled, the schema is mounted into the container and every create/update request is validated against it. The API will fail to start if the schema is invalid. |

charts/templates/configmap-dashboard.yaml

@@ -0,0 +1,12 @@
+{{- if .Values.monitoring.dashboard.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "hyperfleet-api.fullname" . }}-grafana-dashboard
+  labels:
+    {{- include "hyperfleet-api.labels" . | nindent 4 }}
+    grafana_dashboard: "1"
+data:
+  hyperfleet-api.json: |-
+    {{- .Files.Get "dashboards/hyperfleet-api.json" | nindent 4 }}
+{{- end }}

charts/templates/deployment.yaml

@@ -107,7 +107,7 @@ spec:
         # Config file from ConfigMap (generated from values)
         - name: HYPERFLEET_CONFIG
           value: /etc/hyperfleet/config.yaml
-        {{- with .Values.tracing }}
+        {{- with .Values.monitoring.tracing }}
         - name: HYPERFLEET_TRACING_ENABLED
           value: {{ .enabled | quote }}
         {{- if .enabled }}

charts/templates/servicemonitor.yaml

@@ -1,28 +1,38 @@
-{{- if .Values.serviceMonitor.enabled }}
+{{- if .Values.monitoring.serviceMonitor.enabled }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
   name: {{ include "hyperfleet-api.fullname" . }}
-  {{- if .Values.serviceMonitor.namespace }}
-  namespace: {{ .Values.serviceMonitor.namespace }}
+  {{- if .Values.monitoring.serviceMonitor.namespace }}
+  namespace: {{ .Values.monitoring.serviceMonitor.namespace }}
+  {{- else }}
+  namespace: {{ .Release.Namespace }}
   {{- end }}
   labels:
     {{- include "hyperfleet-api.labels" . | nindent 4 }}
-    {{- with .Values.serviceMonitor.labels }}
+    {{- with .Values.monitoring.serviceMonitor.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
 spec:
   selector:
     matchLabels:
       {{- include "hyperfleet-api.selectorLabels" . | nindent 6 }}
-  {{- if .Values.serviceMonitor.namespace }}
+  {{- if not (empty .Values.monitoring.serviceMonitor.namespaceSelector) }}
+  namespaceSelector:
+    {{- toYaml .Values.monitoring.serviceMonitor.namespaceSelector | nindent 4 }}
+  {{- else if .Values.monitoring.serviceMonitor.namespace }}
   namespaceSelector:
     matchNames:
       - {{ .Release.Namespace }}
   {{- end }}
   endpoints:
     - port: metrics
       path: /metrics
-      interval: {{ .Values.serviceMonitor.interval }}
-      scrapeTimeout: {{ .Values.serviceMonitor.scrapeTimeout }}
+      interval: {{ .Values.monitoring.serviceMonitor.interval }}
+      scrapeTimeout: {{ .Values.monitoring.serviceMonitor.scrapeTimeout }}
+      honorLabels: {{ .Values.monitoring.serviceMonitor.honorLabels }}
+      {{- with .Values.monitoring.serviceMonitor.metricRelabeling }}
+      metricRelabelings:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
 {{- end }}

charts/values.schema.json

@@ -188,12 +188,18 @@
                         "description": "HTTP header carrying a pre-authenticated identity (bypasses JWT claim when set)"
                       }
                     },
-                    "required": ["issuer_url"],
+                    "required": [
+                      "issuer_url"
+                    ],
                     "if": {
-                      "required": ["jwk_cert_ca_file"]
+                      "required": [
+                        "jwk_cert_ca_file"
+                      ]
                     },
                     "then": {
-                      "required": ["jwk_cert_url"]
+                      "required": [
+                        "jwk_cert_url"
+                      ]
                     }
                   }
                 }
@@ -416,7 +422,10 @@
           "description": "Entity descriptors registered at startup. Each entry auto-generates REST endpoints, spec validation, and delete policies.",
           "items": {
             "type": "object",
-            "required": ["kind", "plural"],
+            "required": [
+              "kind",
+              "plural"
+            ],
             "properties": {
               "kind": {
                 "type": "string",
@@ -432,7 +441,10 @@
               },
               "on_parent_delete": {
                 "type": "string",
-                "enum": ["restrict", "cascade"],
+                "enum": [
+                  "restrict",
+                  "cascade"
+                ],
                 "description": "Child behavior when parent is deleted (restrict or cascade)"
               },
               "spec_schema_name": {
@@ -441,7 +453,9 @@
               },
               "required_adapters": {
                 "type": "array",
-                "items": { "type": "string" },
+                "items": {
+                  "type": "string"
+                },
                 "description": "Adapters that must finalize before hard-delete"
               },
               "name_min_len": {
@@ -461,7 +475,10 @@
                 "description": "Non-ownership associations to other entity types (HYPERFLEET-1156)",
                 "items": {
                   "type": "object",
-                  "required": ["ref_type", "target_kind"],
+                  "required": [
+                    "ref_type",
+                    "target_kind"
+                  ],
                   "properties": {
                     "ref_type": {
                       "type": "string",
@@ -870,70 +887,130 @@
               }
             }
           }
-        }
-      }
-    },
-    "serviceMonitor": {
-      "type": "object",
-      "description": "ServiceMonitor resource for Prometheus Operator scrape configuration",
-      "properties": {
-        "enabled": {
-          "type": "boolean",
-          "description": "Create a ServiceMonitor resource"
-        },
-        "interval": {
-          "type": "string",
-          "description": "Prometheus scrape interval (e.g. 30s)"
-        },
-        "scrapeTimeout": {
-          "type": "string",
-          "description": "Prometheus scrape timeout (e.g. 10s)"
         },
-        "labels": {
+        "serviceMonitor": {
           "type": "object",
-          "description": "Extra labels applied to the ServiceMonitor for Prometheus selector matching"
-        },
-        "namespace": {
-          "type": "string",
-          "description": "Namespace for the ServiceMonitor; defaults to the release namespace"
-        }
-      }
-    },
-    "tracing": {
-      "type": "object",
-      "description": "Distributed tracing via OpenTelemetry",
-      "properties": {
-        "enabled": {
-          "type": "boolean",
-          "description": "Enable OpenTelemetry tracing"
-        },
-        "serviceName": {
-          "type": "string",
-          "description": "Service name reported in traces"
-        },
-        "otlpEndpoint": {
-          "type": "string",
-          "description": "OTLP exporter endpoint; traces go to stdout if empty"
-        },
-        "otlpProtocol": {
-          "type": "string",
-          "enum": [
-            "grpc",
-            "http/protobuf"
-          ],
-          "description": "OTLP exporter transport protocol"
+          "description": "ServiceMonitor resource for Prometheus Operator scrape configuration",
+          "properties": {
+            "enabled": {
+              "type": "boolean",
+              "description": "Create a ServiceMonitor resource"
+            },
+            "interval": {
+              "type": "string",
+              "description": "Prometheus scrape interval (e.g. 30s)"
+            },
+            "scrapeTimeout": {
+              "type": "string",
+              "description": "Prometheus scrape timeout (e.g. 10s)"
+            },
+            "labels": {
+              "type": "object",
+              "description": "Extra labels applied to the ServiceMonitor for Prometheus selector matching"
+            },
+            "namespace": {
+              "type": "string",
+              "description": "Namespace for the ServiceMonitor; defaults to the release namespace"
+            },
+            "honorLabels": {
+              "type": "boolean",
+              "description": "Honor labels from the target to avoid overwriting"
+            },
+            "metricRelabeling": {
+              "type": "array",
+              "description": "Metric relabel configs applied before ingestion",
+              "items": {
+                "type": "object"
+              }
+            },
+            "namespaceSelector": {
+              "type": "object",
+              "description": "Namespace selector for cross-namespace monitoring"
+            }
+          }
         },
-        "sampler": {
-          "type": "string",
-          "description": "Trace sampler type (e.g. parentbased_traceidratio)"
+        "tracing": {
+          "type": "object",
+          "description": "Distributed tracing via OpenTelemetry",
+          "properties": {
+            "enabled": {
+              "type": "boolean",
+              "description": "Enable OpenTelemetry tracing"
+            },
+            "serviceName": {
+              "type": "string",
+              "description": "Service name reported in traces"
+            },
+            "otlpEndpoint": {
+              "type": "string",
+              "description": "OTLP exporter endpoint; traces go to stdout if empty"
+            },
+            "otlpProtocol": {
+              "type": "string",
+              "enum": [
+                "grpc",
+                "http/protobuf"
+              ],
+              "description": "OTLP exporter transport protocol"
+            },
+            "sampler": {
+              "type": "string",
+              "description": "Sampler type"
+            },
+            "samplerArg": {
+              "type": "string",
+              "description": "Sampling rate (only used with ratio-based samplers)"
+            },
+            "propagators": {
+              "type": "string",
+              "description": "Comma-separated list of context propagators (e.g. tracecontext,baggage)"
+            }
+          }
         },
-        "samplerArg": {
-          "type": "string",
-          "description": "Sampler argument; for traceidratio this is the sampling rate (0.0-1.0)"
+        "dashboard": {
+          "type": "object",
+          "description": "Grafana dashboard provisioning via sidecar ConfigMap",
+          "properties": {
+            "enabled": {
+              "type": "boolean",
+              "description": "Create a ConfigMap with the Grafana dashboard JSON"
+            }
+          }
         },
-        "propagators": {
-          "type": "string",
-          "description": "Comma-separated list of context propagators (e.g. tracecontext,baggage)"
+        "podMonitoring": {
+          "type": "object",
+          "description": "PodMonitoring for Google Managed Prometheus (GMP) scraping",
+          "properties": {
+            "enabled": {
+              "type": "boolean",
+              "description": "Create a PodMonitoring resource"
+            },
+            "interval": {
+              "type": "string",
+              "description": "Scrape interval (e.g. 30s)"
+            },
+            "additionalLabels": {
+              "type": "object",
+              "description": "Additional labels for the PodMonitoring resource"
+            },
+            "metricRelabeling": {
+              "type": "array",
+              "description": "Metric relabel configs applied before ingestion",
+              "items": {
+                "type": "object"
+              }
+            },
+            "tlsConfig": {
+              "type": "object",
+              "description": "TLS configuration for metrics endpoint",
+              "properties": {
+                "insecureSkipVerify": {
+                  "type": "boolean",
+                  "description": "Disable target certificate validation"
+                }
+              }
+            }
+          }
         }
       }
     },