Add signoz

infrastructure/kubernetes/overlays/dev/kustomization.yaml

@@ -9,11 +9,14 @@ metadata:
 
 resources:
   - ../../base
-  # Monitoring disabled for dev to save resources
-  # - ../../base/components/monitoring
+  # Monitoring enabled for dev environment
+  - ../../base/components/monitoring
   - dev-ingress.yaml
+  # SigNoz ingress is applied by Tilt (see Tiltfile)
+  # - signoz-ingress.yaml
   # Dev-Prod Parity: Enable HTTPS with self-signed certificates
   - dev-certificate.yaml
+  - monitoring-certificate.yaml
   - cluster-issuer-staging.yaml
 
 # Exclude nominatim from dev to save resources
@@ -608,6 +611,39 @@ patches:
           limits:
             memory: "512Mi"
             cpu: "300m"
+  # Optional exporters resource patches for dev
+  - target:
+      group: apps
+      version: v1
+      kind: DaemonSet
+      name: node-exporter
+      namespace: monitoring
+    patch: |-
+      - op: replace
+        path: /spec/template/spec/containers/0/resources
+        value:
+          requests:
+            memory: "32Mi"
+            cpu: "25m"
+          limits:
+            memory: "64Mi"
+            cpu: "100m"
+  - target:
+      group: apps
+      version: v1
+      kind: Deployment
+      name: postgres-exporter
+      namespace: monitoring
+    patch: |-
+      - op: replace
+        path: /spec/template/spec/containers/0/resources
+        value:
+          requests:
+            memory: "32Mi"
+            cpu: "25m"
+          limits:
+            memory: "64Mi"
+            cpu: "100m"
 
 secretGenerator:
   - name: dev-secrets

infrastructure/kubernetes/overlays/dev/monitoring-certificate.yaml

@@ -0,0 +1,49 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: bakery-dev-monitoring-tls-cert
+  namespace: monitoring
+spec:
+  # Self-signed certificate for local development
+  secretName: bakery-ia-tls-cert
+
+  # Certificate duration
+  duration: 2160h # 90 days
+  renewBefore: 360h # 15 days
+
+  # Subject configuration
+  subject:
+    organizations:
+      - Bakery IA Development
+
+  # Common name
+  commonName: localhost
+
+  # DNS names this certificate is valid for
+  dnsNames:
+    - localhost
+    - monitoring.bakery-ia.local
+
+  # IP addresses (for localhost)
+  ipAddresses:
+    - 127.0.0.1
+    - ::1
+
+  # Use self-signed issuer for development
+  issuerRef:
+    name: selfsigned-issuer
+    kind: ClusterIssuer
+    group: cert-manager.io
+
+  # Private key configuration
+  privateKey:
+    algorithm: RSA
+    encoding: PKCS1
+    size: 2048
+
+  # Usages
+  usages:
+    - server auth
+    - client auth
+    - digital signature
+    - key encipherment

infrastructure/kubernetes/overlays/dev/signoz-ingress.yaml

@@ -0,0 +1,39 @@
+---
+# SigNoz Ingress for Development (localhost)
+# SigNoz is deployed via Helm in the 'signoz' namespace
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: signoz-ingress-localhost
+  namespace: signoz
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/rewrite-target: /$2
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - localhost
+    secretName: bakery-ia-tls-cert
+  rules:
+  - host: localhost
+    http:
+      paths:
+      # SigNoz Frontend UI
+      - path: /signoz(/|$)(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: signoz-frontend
+            port:
+              number: 3301
+      # SigNoz Query Service API
+      - path: /signoz-api(/|$)(.*)
+        pathType: ImplementationSpecific
+        backend:
+          service:
+            name: signoz-query-service
+            port:
+              number: 8080