---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: netdata
  namespace: common-services
spec:
  interval: 1m0s

  chart:
    spec:
      chart: netdata
      version: 3.7.158
      sourceRef:
        kind: HelmRepository
        name: netdata
        namespace: common-services

  # Injecte APIKEY depuis un Secret (pas en clair dans Git)
  valuesFrom:
    - kind: Secret
      name: netdata-stream
      valuesKey: APIKEY
      targetPath: APIKEY

  values:
    image:
      tag: v2.8.5

    # Service interne uniquement
    service:
      type: ClusterIP
      port: 19999

    # Pas d'exposition
    ingress:
      enabled: false

    # Pas d'auto-update des pods en prod critique
    restarter:
      enabled: false

    # Parent = point de centralisation + health/alerting (par défaut chart)
    parent:
      enabled: true
      port: 19999

      resources:
        requests:
          cpu: "${NETDATA_PARENT_REQUESTS_CPU}"
          memory: "${NETDATA_PARENT_REQUESTS_RAM}"
        limits:
          cpu: "${NETDATA_PARENT_LIMITS_CPU}"
          memory: "${NETDATA_PARENT_LIMITS_RAM}"

      # PV parent recommandés (db + alarms)
      database:
        persistence: true
        volumesize: 40Gi # /var/cache/netdata
      alarms:
        persistence: true
        volumesize: 4Gi # /var/lib/netdata

      # Claiming via Secret envFrom
      claiming:
        enabled: true
        token: ""
        rooms: ""
        url: "https://api.netdata.cloud"
      envFrom:
        - secretRef:
            name: netdata-claim

    # Child DaemonSet
    child:
      enabled: true
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet

      resources:
        requests:
          cpu: "${NETDATA_CHILD_REQUESTS_CPU}"
          memory: "${NETDATA_CHILD_REQUESTS_RAM}"
        limits:
          cpu: "${NETDATA_CHILD_LIMITS_CPU}"
          memory: "${NETDATA_CHILD_LIMITS_RAM}"

      persistence:
        enabled: true
        hostPath: /var/lib/netdata-k8s-child

      # Hardening UI sur les nodes: bind localhost uniquement
      configs:
        netdata:
          enabled: true
          path: /etc/netdata/netdata.conf
          data: |
            [db]
              mode = ram
              retention = "${NETDATA_CHILD_RETENTION}"
              update every = "${NETDATA_CHILD_COLLECT_INTERVAL}"
            [web]
              bind to = localhost:19999
            [health]
              enabled = no
            [ml]
              enabled = no

      # Claiming via Secret envFrom (token PAS en clair ici)
      claiming:
        enabled: true
        token: ""
        rooms: ""
        url: "https://api.netdata.cloud"
      envFrom:
        - secretRef:
            name: netdata-claim