Grafana Integration for Private Mendix Platform

export monitorNs=grafana
export grafanaAdminPass="xxxxx"
helm repo add grafana https://grafana.github.io/helm-charts
helm repo update
kubectl create namespace ${monitorNs} --dry-run=client -o yaml | kubectl apply -f -
kubectl --namespace ${monitorNs} create secret generic grafana-admin --from-literal=admin-user=Admin --from-literal=admin-password=${grafanaAdminPass}
helm upgrade --install loki grafana/loki-stack --version='^2.10.2' --namespace=${monitorNs} \
  --set grafana.enabled=true \
  --set grafana.persistence.enabled=true \
  --set grafana.persistence.size=1Gi \
  --set grafana.initChownData.enabled=false \
  --set grafana.admin.existingSecret=grafana-admin \
  --set prometheus.enabled=true \
  --set prometheus.server.persistentVolume.enabled=true \
  --set prometheus.server.persistentVolume.size=50Gi \
  --set prometheus.server.retention=7d \
  --set loki.persistence.enabled=true \
  --set loki.persistence.size=10Gi \
  --set loki.config.chunk_store_config.max_look_back_period=168h \
  --set loki.config.table_manager.retention_deletes_enabled=true \
  --set loki.config.table_manager.retention_period=168h \
  --set promtail.enabled=true \
  --set promtail.containerSecurityContext.privileged=true \
  --set promtail.containerSecurityContext.allowPrivilegeEscalation=true \
  --set prometheus.kubeStateMetrics.enabled=true \
  --set prometheus.kubeStateMetrics.resources.limits.memory=512Mi \
  --set prometheus.cadvisor.enabled=true \
  --set prometheus.nodeExporter.enabled=true \
  --set prometheus.alertmanager.enabled=false \
  --set prometheus.pushgateway.enabled=false

# --- Configuration Variables ---
# Define the Kubernetes namespace where all monitoring components will be deployed.
# Using a dedicated namespace helps organize resources and manage access control.
# Define the password for the Grafana 'Admin' user.
# IMPORTANT: Replace 'xxxxx' with a strong, secure password.
# --- Helm Repository Management ---
# Add the official Grafana Helm repository. This repository contains the charts for Loki-Stack, Grafana, etc.
# This command makes the Grafana charts available for Helm to use.
# Update your local Helm chart repositories.
# This fetches the latest information about charts from all added repositories, ensuring you can install
# the most recent versions and bug fixes.
# --- Kubernetes Namespace Creation ---
# Create the Kubernetes namespace defined by the 'monitorNs' variable (e.g., 'grafana').
# '--dry-run=client -o yaml': Generates the YAML output for the namespace without actually creating it.
# '| kubectl apply -f -': Pipes the generated YAML to 'kubectl apply', which then creates the namespace.
# This approach is idempotent, meaning it won't fail if the namespace already exists.
# --- Grafana Admin Secret Creation ---
# Create a Kubernetes secret to store the Grafana administrator username and password.
# This secret is later referenced by the Grafana Helm chart to configure the admin user.
# '--namespace ${monitorNs}': Specifies that the secret should be created in the designated monitoring namespace.
# 'create secret generic grafana-admin': Creates a generic secret named 'grafana-admin'.
# '--from-literal=admin-user=Admin': Sets the username for Grafana to 'Admin'.
# '--from-literal=admin-password=${grafanaAdminPass}': Sets the password for Grafana using the value from 'grafanaAdminPass'.
# --- Set Default StorageClass (Important for Persistent Volumes) ---
# This command identifies the first available StorageClass in your Kubernetes cluster and
# patches it to be the default StorageClass.
# This is crucial because many Helm charts (including Loki-Stack) request Persistent Volumes
# without explicitly specifying a StorageClass. If no default is set, PVCs might remain pending.
#
# 'kubectl get storageclass -o json': Retrieves all StorageClasses in JSON format.
# '| jq -r '.items[0].metadata.name'': Uses 'jq' (a JSON processor) to extract the name
#                                     of the first StorageClass found.
# '-p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'':
#   Patches the identified StorageClass to add the annotation that marks it as the default.
#
# NOTE: If you have multiple StorageClasses and want a specific one to be default,
#       you might need to adjust the 'jq' filter or manually specify the StorageClass name.
# --- Install/Upgrade Grafana Loki-Stack with Helm ---
# This is the main command to deploy the entire monitoring stack.
# 'helm upgrade --install loki grafana/loki-stack':
#   - 'upgrade': Attempts to upgrade an existing release named 'loki'.
#   - '--install': If no release named 'loki' exists, it will install a new one.
#   - 'loki': The name of the Helm release.
#   - 'grafana/loki-stack': Specifies the chart to use from the 'grafana' repository.
#
# '--version='^2.10.2'': Specifies the version range for the loki-stack chart.
#                     '^2.10.2' means any version starting with 2.10.2 but less than 2.11.0.
#                     
# '--namespace=${monitorNs}': Deploys all resources within the specified Kubernetes namespace.
#
# --- Grafana Configuration ---
# '--set grafana.enabled=true': Enables the Grafana dashboard component within the stack.
# '--set grafana.persistence.enabled=true': Enables persistent storage for Grafana.
#                                         This ensures dashboards, users, and settings are saved across restarts.
# '--set grafana.persistence.size=1Gi': Sets the size of the Persistent Volume Claim (PVC) for Grafana to 1 Gigabyte.
# '--set grafana.initChownData.enabled=false': Disables the init container that changes ownership of persistent data.
#                                            This can sometimes cause issues with certain StorageClasses or security contexts.
# '--set grafana.admin.existingSecret=grafana-admin': Tells Grafana to use the Kubernetes secret named 'grafana-admin'
#                                                   (created earlier) for its admin user credentials.
#
# --- Prometheus Configuration ---
# '--set prometheus.enabled=true': Enables the Prometheus monitoring system within the stack.
# '--set prometheus.server.persistentVolume.enabled=true': Enables persistent storage for Prometheus server data.
#                                                        This saves your metrics data.
# '--set prometheus.server.persistentVolume.size=50Gi': Sets the size of the PVC for Prometheus server to 50 Gigabytes.
# '--set prometheus.server.retention=7d': Configures Prometheus to retain metrics data for 7 days.
#
# --- Loki Configuration ---
# '--set loki.persistence.enabled=true': Enables persistent storage for Loki's logs and index data.
#                                      This is crucial for retaining your log data.
# '--set loki.persistence.size=10Gi': Sets the size of the PVC for Loki to 10 Gigabytes.
# '--set loki.config.chunk_store_config.max_look_back_period=168h':
#   Configures Loki's chunk store to allow querying logs up to 168 hours (7 days) back.
# '--set loki.config.table_manager.retention_deletes_enabled=true':
#   Enables Loki's table manager to delete old data based on retention policies.
# '--set loki.config.table_manager.retention_period=168h':
#   Sets Loki's retention period for log data to 168 hours (7 days). Data older than this will be deleted.
#
# --- Promtail Configuration ---
# Promtail is an agent that ships logs from your Kubernetes nodes to Loki.
# '--set promtail.enabled=true': Enables the Promtail agent within the stack.
# '--set promtail.containerSecurityContext.privileged=true':
#   Grants the Promtail container privileged access. This is often required for Promtail
#   to read logs from all directories on the host, including those usually protected.
#   WARNING: Granting privileged access should be done with caution and understanding of security implications.
# '--set promtail.containerSecurityContext.allowPrivilegeEscalation=true':
#   Allows the Promtail process to gain more privileges than its parent process.
#   This is often needed in conjunction with 'privileged=true'.
#
# --- Prometheus Exporters Configuration ---
# Exporters are agents that expose metrics from various services for Prometheus to scrape.
# '--set prometheus.kubeStateMetrics.enabled=true':
#   Enables kube-state-metrics, which provides metrics about the state of Kubernetes objects
#   (e.g., deployments, pods, nodes).
# '--set prometheus.kubeStateMetrics.resources.limits.memory=512Mi':
#   Sets a memory limit of 512 MiB for the kube-state-metrics pod to prevent it from consuming excessive resources.
# '--set prometheus.cadvisor.enabled=true':
#   Enables cAdvisor, which collects resource usage and performance metrics from containers.
#   This is typically run as part of the Kubelet on each node.
# '--set prometheus.nodeExporter.enabled=true':
#   Enables the Prometheus Node Exporter, which exposes host-level metrics (CPU, memory, disk, network)
#   from the Kubernetes nodes.
# '--set prometheus.alertmanager.enabled=false': Disables the Prometheus Alertmanager component.
#                                              Enable this if you need alerting functionality.
# '--set prometheus.pushgateway.enabled=false': Disables the Prometheus Pushgateway component.
#                                             Enable this if you have ephemeral jobs that push metrics.

glsa_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX