FEAT(thanos): add Thanos for Prometheus HA

- Add Thanos Query, Store Gateway, Compactor
- Enable Prometheus Sidecar with S3 (MinIO) storage
- Configure OCI registry for Bitnami chart
- Fix Vault secret path and image settings
- Add nodeSelector for master node

prometheus/manifests/secret.yaml

@@ -43,9 +43,9 @@ spec:
   data:
     - secretKey: access_key
       remoteRef:
-        key: secret/minio
+        key: minio
-        property: root-user
+        property: ROOT_USER
     - secretKey: secret_key
       remoteRef:
-        key: secret/minio
+        key: minio
-        property: root-password
+        property: ROOT_PASSWORD

thanos/argocd.yaml

@@ -8,7 +8,7 @@ metadata:
 spec:
   project: default
   sources:
-  - repoURL: https://charts.bitnami.com/bitnami
+  - repoURL: registry-1.docker.io/bitnamicharts
     chart: thanos
     targetRevision: 17.3.1
     helm:

thanos/helm-values.yaml

@@ -7,6 +7,12 @@
 # - Store Gateway: reads historical data from MinIO
 # - Compactor: compacts and downsamples data in MinIO
 
+# Use quay.io image to avoid Docker Hub rate limits
+image:
+  registry: quay.io
+  repository: thanos/thanos
+  tag: v0.37.2
+
 # Object storage configuration (MinIO S3)
 # Uses secret created by ExternalSecret
 existingObjstoreSecret: thanos-objstore-secret
@@ -24,9 +30,8 @@ query:
     sidecarsService: prometheus-kube-prometheus-thanos-discovery
     sidecarsNamespace: prometheus
 
-  # Store endpoints for historical data
+  # Store endpoints - chart automatically adds storegateway
-  stores:
+  # No need to specify manually
-    - dnssrv+_grpc._tcp.thanos-storegateway.thanos.svc.cluster.local
 
   # Deduplication settings
   extraFlags:

thanos/manifests/secret.yaml

@@ -24,9 +24,9 @@ spec:
   data:
     - secretKey: access_key
       remoteRef:
-        key: secret/minio
+        key: minio
-        property: root-user
+        property: ROOT_USER
     - secretKey: secret_key
       remoteRef:
-        key: secret/minio
+        key: minio
-        property: root-password
+        property: ROOT_PASSWORD