add creds

Reviewed-on: #1

README.md

@@ -2,6 +2,15 @@
 
 If you plan to connect the node to Netdata Cloud, you can find the command with the right parameters by clicking the "Add Nodes" button in your Space's Nodes tab.
 
+File generated by Claude
+
+To apply:
+```
+kubectl apply -k .
+```
+
+
+
 File generated using the following command
 ```
 helm repo add netdata https://netdata.github.io/helmchart/ && helm repo update

child/conf/go.d.yaml

@@ -0,0 +1,3 @@
+modules:
+  pulsar: no
+  prometheus: yes

child/conf/kubelet.yaml

@@ -0,0 +1,8 @@
+update_every: 1
+autodetection_retry: 0
+jobs:
+  - name: local
+    url: http://127.0.0.1:10255/metrics
+  - name: local
+    url: https://localhost:10250/metrics
+    tls_skip_verify: yes

child/conf/kubeproxy.yaml

@@ -0,0 +1,5 @@
+update_every: 1
+autodetection_retry: 0
+jobs:
+  - name: local
+    url: http://127.0.0.1:10249/metrics

child/conf/netdata.conf

@@ -0,0 +1,8 @@
+[db]
+  mode = ram
+[web]
+  bind to = localhost:19999
+[health]
+  enabled = no
+[ml]
+  enabled = no

child/conf/otel.yaml

@@ -0,0 +1,37 @@
+# OpenTelemetry Plugin Configuration
+# To customize, run: edit-config otel.yaml
+# Only include the fields you want to change — missing fields keep their defaults.
+
+endpoint:
+  path: "127.0.0.1:4317"
+  tls_cert_path: null
+  tls_key_path: null
+  tls_ca_cert_path: null
+
+metrics:
+  chart_configs_dir: /etc/netdata/otel.d/v1/metrics
+  interval_secs: 10
+  grace_period_secs: 60
+  expiry_duration_secs: 900
+  max_new_charts_per_request: 100
+
+base_dir: /var/log/netdata/otel/v2
+
+remote_storage:
+  enabled: false
+  uri: "fs:///var/log/netdata/otel/v2/remote"
+  read_cache_max_size: "1GB"
+
+auth:
+  enabled: false
+
+logs:
+  rotation:
+    default:
+      max_file_size: "25MB"
+      max_entries: 50000
+  retention:
+    default:
+      max_files: 100000
+      max_total_size: "1GB"
+      max_age: "7 days"

child/conf/sd-config.yml

@@ -0,0 +1,242 @@
+disabled: no
+
+name: 'kubernetes'
+
+discover:
+  - discoverer: k8s
+    k8s:
+      - tags: unknown
+        role: pod
+        pod:
+          local_mode: yes
+classify:
+  - name: "Control-Plane"
+    selector: unknown
+    tags: -unknown control_plane
+    match:
+      - tags: kube_scheduler
+        expr: '{{ glob .Image "k8s.gcr.io/kube-scheduler:*" }}'
+      - tags: kube_controller_manager
+        expr: '{{ glob .Image "k8s.gcr.io/kube-controller-manager:*" }}'
+  - name: "Applications"
+    selector: unknown
+    tags: -unknown applications
+    match:
+      - tags: activemq
+        expr: '{{ and (eq .Port "8161") (glob .Image "*/activemq*") }}'
+      - tags: apache
+        expr: '{{ and (eq .Port "80" "8080") (glob .Image "httpd*" "*/httpd*") }}'
+      - tags: bind
+        expr: '{{ and (eq .Port "8653") (glob .Image "*/bind*") }}'
+      - tags: cockroachdb
+        expr: '{{ and (eq .Port "8080") (glob .Image "*/cockroach*") }}'
+      - tags: consul
+        expr: '{{ and (eq .Port "8500") (glob .Image "consul*" "*/consul*") }}'
+      - tags: coredns
+        expr: '{{ and (eq .Port "9153") (glob .Image "*/coredns*") }}'
+      - tags: elasticsearch
+        expr: '{{ and (eq .Port "9200") (glob .Image "elasticsearch:*" "*/elasticsearch:*") }}'
+      - tags: fluentd
+        expr: '{{ and (eq .Port "24220") (glob .Image "fluentd*" "*/fluentd*") }}'
+      - tags: freeradius
+        expr: '{{ and (eq .Port "18121") (glob .Image "*/freeradius*") }}'
+      - tags: hdfs
+        expr: '{{ and (eq .Port "50070") (glob .Image "*/hdfs*") }}'
+      - tags: lighttpd
+        expr: '{{ and (eq .Port "80" "8080") (glob .Image "*/lighttpd*") }}'
+      - tags: logstash
+        expr: '{{ and (eq .Port "9600") (glob .Image "logstash*" "*/logstash*") }}'
+      - tags: mysql
+        expr: '{{ and (eq .Port "3306") (glob .Image "mysql*" "*/mysql*" "mariadb*" "*/mariadb*") }}'
+      - tags: nginx
+        expr: '{{ and (eq .Port "80" "8080") (glob .Image "nginx*" "*/nginx*") }}'
+      - tags: openvpn
+        expr: '{{ and (eq .Port "7505") (glob .Image "*/openvpn") }}'
+      - tags: phpfpm
+        expr: '{{ and (eq .Port "80" "8080") (glob .Image "*/phpfpm*" "*/php-fpm*") }}'
+      - tags: rabbitmq
+        expr: '{{ and (eq .Port "15672") (glob .Image "rabbitmq*" "*/rabbitmq*") }}'
+      - tags: solr
+        expr: '{{ and (eq .Port "8983") (glob .Image "solr*" "*/solr*") }}'
+      - tags: tengine
+        expr: '{{ and (eq .Port "80" "8080") (glob .Image "*/tengine*") }}'
+      - tags: unbound
+        expr: '{{ and (eq .Port "8953") (glob .Image "*/unbound*") }}'
+      - tags: vernemq
+        expr: '{{ and (eq .Port "8888") (glob .Image "*/vernemq*") }}'
+      - tags: zookeeper
+        expr: '{{ and (eq .Port "2181") (glob .Image "zookeeper*" "*/zookeeper*") }}'
+      - tags: consul_envoy
+        expr: |
+          {{ $imageOK := glob .Image "*/consul-dataplane*" -}}
+          {{ $scrapeOK := eq (get .Annotations "prometheus.io/scrape") "true" -}}
+          {{ $promPort := get .Annotations "prometheus.io/port" -}}
+          {{ $portOK1 := and (eq .Port $promPort) (not (empty .Port)) -}}
+          {{ $portOK2 := and (empty .Port) (not (empty $promPort)) -}}
+          {{ and $imageOK $scrapeOK (or $portOK1 $portOK2) }}
+  - name: "Prometheus Generic Applications"
+    selector: unknown
+    tags: -unknown prometheus_generic
+    match:
+      - tags: prometheus_generic
+        expr: |
+          {{ $scrapeOK := eq (get .Annotations "prometheus.io/scrape") "true" -}}
+          {{ $portOK := eq (default .Port (get .Annotations "prometheus.io/port")) .Port -}}
+          {{ $imageOK := not (glob .Image "netdata/netdata*" "*pulsar*" "*telegraf*") -}}
+          {{ and $scrapeOK $portOK $imageOK }}
+compose:
+  - name: "Control-Plane"
+    selector: '!unknown control_plane'
+    config:
+      - selector: kube_scheduler
+        template: |
+          - module: prometheus
+            name: prometheus-{{.TUID}}
+            url: http://{{.PodIP}}:{{default "10251" .Port}}/metrics
+            app: '{{.ContName}}'
+            update_every: 10
+            max_time_series: 1000
+      - selector: kube_controller_manager
+        template: |
+          - module: prometheus
+            name: prometheus-{{.TUID}}
+            url: http://{{.PodIP}}:{{default "10252" .Port}}/metrics
+            app: '{{.ContName}}'
+            update_every: 10
+            max_time_series: 2000
+  - name: "Prometheus Generic Applications"
+    selector: '!unknown prometheus_generic'
+    config:
+      - selector: prometheus_generic
+        template: |
+          {{ $path := default "/metrics" (get .Annotations "prometheus.io/path") -}}
+          - module: prometheus
+            name: prometheus-{{.TUID}}
+            url: http://{{.Address}}{{$path}}
+            app: '{{.ContName}}'
+            update_every: 10
+            max_time_series: 4000
+  - name: "Applications"
+    selector: '!unknown applications'
+    tags: file
+    config:
+      - selector: activemq
+        template: |
+          - module: activemq
+            name: activemq-{{.TUID}}
+            url: http://{{.Address}}
+      - selector: apache
+        template: |
+          - module: apache
+            name: apache-{{.TUID}}
+            url: http://{{.Address}}/server-status?auto
+      - selector: bind
+        template: |
+          - module: bind
+            name: bind-{{.TUID}}
+            url: http://{{.Address}}/json/v1
+      - selector: cockroachdb
+        template: |
+          - module: cockroachdb
+            name: cockroachdb-{{.TUID}}
+            url: http://{{.Address}}/_status/vars
+      - selector: consul
+        template: |
+          - module: consul
+            name: consul-{{.TUID}}
+            url: http://{{.Address}}
+      - selector: coredns
+        template: |
+          - module: coredns
+            name: coredns-{{.TUID}}
+            url: http://{{.Address}}/metrics
+      - selector: elasticsearch
+        template: |
+          - module: elasticsearch
+            name: elasticsearch-{{.TUID}}
+            url: http://{{.Address}}
+      - selector: consul_envoy
+        template: |
+          {{ $path := default "/metrics" (get .Annotations "prometheus.io/path") -}}
+          {{ $promPort := get .Annotations "prometheus.io/port" -}}
+          {{ $port := ternary .Port $promPort (not (empty .Port)) -}}
+          - module: envoy
+            name: {{.TUID}}
+            url: http://{{ .PodIP }}:{{ $port }}{{ $path }}
+      - selector: fluentd
+        template: |
+          - module: fluentd
+            name: fluentd-{{.TUID}}
+            url: http://{{.Address}}
+      - selector: freeradius
+        template: |
+          - module: freeradius
+            name: freeradius-{{.TUID}}
+            address: {{.PodIP}}
+            port: {{.Port}}
+      - selector: hdfs
+        template: |
+          - module: hdfs
+            name: hdfs-{{.TUID}}
+            url: http://{{.Address}}/jmx
+      - selector: lighttpd
+        template: |
+          - module: lighttpd
+            name: lighttpd-{{.TUID}}
+            url: http://{{.Address}}/server-status?auto
+      - selector: logstash
+        template: |
+          - module: logstash
+            name: logstash-{{.TUID}}
+            url: http://{{.Address}}
+      - selector: mysql
+        template: |
+          - module: mysql
+            name: mysql-{{.TUID}}
+            dsn: 'netdata@tcp({{.Address}})/'
+      - selector: nginx
+        template: |
+          - module: nginx
+            name: nginx-{{.TUID}}
+            url: http://{{.Address}}/stub_status
+      - selector: openvpn
+        template: |
+          - module: openvpn
+            name: openvpn-{{.TUID}}
+            address: {{.Address}}
+      - selector: phpfpm
+        template: |
+          - module: phpfpm
+            name: phpfpm-{{.TUID}}
+            url: http://{{.Address}}/status?full&json
+      - selector: rabbitmq
+        template: |
+          - module: rabbitmq
+            name: rabbitmq-{{.TUID}}
+            url: http://{{.Address}}
+      - selector: solr
+        template: |
+          - module: solr
+            name: solr-{{.TUID}}
+            url: http://{{.Address}}
+      - selector: tengine
+        template: |
+          - module: tengine
+            name: tengine-{{.TUID}}
+            url: http://{{.Address}}/us
+      - selector: unbound
+        template: |
+          - module: unbound
+            name: unbound-{{.TUID}}
+            address: {{.Address}}
+            use_tls: false
+      - selector: vernemq
+        template: |
+          - module: vernemq
+            name: vernemq-{{.TUID}}
+            url: http://{{.Address}}/metrics
+      - selector: zookeeper
+        template: |
+          - module: zookeeper
+            name: zookeeper-{{.TUID}}
+            address: {{.Address}}

child/conf/stream.conf

@@ -0,0 +1,8 @@
+[stream]
+  enabled = yes
+  destination = netdata:19999
+  api key = 11111111-2222-3333-4444-555555555555
+  timeout seconds = 60
+  buffer size bytes = 1048576
+  reconnect delay seconds = 5
+  initial clock resync iterations = 60

child/conf/web_log.yaml

@@ -0,0 +1,7 @@
+jobs:
+  - name: django_testing
+    path: /host/var/log/pods/django-testing_django-testing-7f89d9ffc5-mcm9g_ad5b3bbf-33ca-410f-aa0e-457664c6345b/django-testing/0.log
+    log_type: auto
+  - name: nginx
+    path: /host/var/log/pods/reverse-proxy_reverse-proxy-67c767c86f-pxvdz_af6033a7-dfcb-4430-a67b-ee75ea424cf7/reverse-proxy/0.log
+    log_type: auto

child/daemonset.yaml

@@ -0,0 +1,153 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: netdata-child
+  labels:
+    app: netdata
+    role: child
+spec:
+  selector:
+    matchLabels:
+      app: netdata
+      role: child
+  template:
+    metadata:
+      annotations:
+        container.apparmor.security.beta.kubernetes.io/netdata: unconfined
+      labels:
+        app: netdata
+        role: child
+    spec:
+      serviceAccountName: netdata
+      restartPolicy: Always
+      hostPID: true
+      hostIPC: true
+      hostNetwork: true
+      initContainers:
+        - name: init-persistence
+          image: "alpine:latest"
+          resources:
+            requests:
+              cpu: 10m
+          imagePullPolicy: Always
+          volumeMounts:
+            - name: persistencevarlibdir
+              mountPath: "/persistencevarlibdir"
+          command: ["/bin/sh"]
+          args:
+            - "-c"
+            - "chmod 777 /persistencevarlibdir;"
+      containers:
+        - name: netdata
+          image: "netdata/netdata:edge"
+          imagePullPolicy: Always
+          env:
+            - name: NETDATA_CLAIM_URL
+              value: "https://api.netdata.cloud"
+            - name: NETDATA_CLAIM_TOKEN
+              value: "CIlCwV6GawNWIfhrqMVmPAJixo_BSaGvwVbHKFOCQCHbYG5J8Ac0FDxKrObJ727F1dndg8J-v6apUhzGho6RIOlkrqJ_F7DKodjLqbsSWb7Ta-GSHkkuHcTXidxKxEo5RK0jiqU"
+            - name: NETDATA_CLAIM_ROOMS
+              value: "e15a4f12-89d7-4d5b-b588-6658fa835473"
+            - name: MY_POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: MY_NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+            - name: MY_POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: NETDATA_LISTENER_PORT
+              value: '19999'
+          ports:
+            - name: http
+              containerPort: 19999
+              protocol: TCP
+          livenessProbe:
+            exec:
+              command: ["/usr/sbin/netdatacli", "ping"]
+            initialDelaySeconds: 0
+            failureThreshold: 3
+            periodSeconds: 30
+            successThreshold: 1
+            timeoutSeconds: 1
+          readinessProbe:
+            exec:
+              command: ["/usr/sbin/netdatacli", "ping"]
+            initialDelaySeconds: 0
+            failureThreshold: 3
+            periodSeconds: 30
+            successThreshold: 1
+            timeoutSeconds: 1
+          volumeMounts:
+            - name: proc
+              readOnly: true
+              mountPath: /host/proc
+            - name: sys
+              mountPath: /host/sys
+            - name: os-release
+              mountPath: /host/etc/os-release
+            - name: varlog
+              mountPath: /host/var/log
+            - name: configmap
+              mountPath: /etc/netdata/go.d.conf
+              subPath: go.d
+            - name: configmap
+              mountPath: /etc/netdata/go.d/k8s_kubelet.conf
+              subPath: kubelet
+            - name: configmap
+              mountPath: /etc/netdata/go.d/k8s_kubeproxy.conf
+              subPath: kubeproxy
+            - name: configmap
+              mountPath: /etc/netdata/go.d/web_log.conf
+              subPath: web_log
+            - name: configmap
+              mountPath: /etc/netdata/netdata.conf
+              subPath: netdata
+            - name: configmap
+              mountPath: /etc/netdata/stream.conf
+              subPath: stream
+            - name: persistencevarlibdir
+              mountPath: /var/lib/netdata
+            - name: sdconfigmap
+              mountPath: "/etc/netdata/go.d/sd/k8s.conf"
+              subPath: config.yml
+          securityContext:
+            capabilities:
+              add:
+                - SYS_PTRACE
+                - SYS_ADMIN
+          resources: {}
+      tolerations:
+        - effect: NoSchedule
+          operator: Exists
+      terminationGracePeriodSeconds: 30
+      volumes:
+        - name: proc
+          hostPath:
+            path: /proc
+        - name: sys
+          hostPath:
+            path: /sys
+        - name: os-release
+          hostPath:
+            path: /etc/os-release
+        - name: varlog
+          hostPath:
+            path: /var/log
+        - name: configmap
+          configMap:
+            name: netdata-conf-child
+            optional: true
+        - name: persistencevarlibdir
+          hostPath:
+            path: /var/lib/netdata-k8s-child/var/lib/netdata
+            type: DirectoryOrCreate
+        - name: sdconfigmap
+          configMap:
+            name: netdata-child-sd-config-map
+            optional: true
+      dnsPolicy: ClusterFirstWithHostNet

k8s-state/conf/dnsquery.yaml

@@ -0,0 +1,14 @@
+update_every: 3600
+autodetection_retry: 0
+jobs:
+  - name: job1
+    record_types:
+      - A
+      - AAAA
+    domains:
+      - google.com
+      - github.com
+      - gitea.tryton.geeraert.eu
+    servers:
+      - 8.8.8.8
+      - 8.8.4.4

k8s-state/conf/go.d-k8s_state.yaml

@@ -0,0 +1,3 @@
+jobs:
+  - name: k8s_state
+    update_every: 1

k8s-state/conf/go.d.yaml

@@ -0,0 +1,6 @@
+default_run: no
+modules:
+  k8s_state: yes
+  httpcheck: yes
+  dnsquery: yes
+  x509check: yes

k8s-state/conf/httpcheck.yaml

@@ -0,0 +1,11 @@
+update_every: 1
+autodetection_retry: 0
+jobs:
+  - name: gitea
+    url: https://gitea.tryton.geeraert.eu:443
+    headers:
+      Host: localhost:8080
+      User-Agent: netdata/go.d.plugin
+      Accept: "*/*"
+  - name: bitwarden
+    url: https://bitwarden.tryton.geeraert.eu:443

k8s-state/conf/netdata.conf

@@ -0,0 +1,28 @@
+[global]
+  hostname = netdata-k8s-state
+[db]
+  mode = ram
+[web]
+  bind to = localhost:19999
+[health]
+  enabled = no
+[ml]
+  enabled = no
+[plugins]
+  timex = no
+  checks = no
+  idlejitter = no
+  tc = no
+  diskspace = no
+  proc = no
+  cgroups = no
+  enable running new plugins = no
+  slabinfo = no
+  perf = no
+  go.d = yes
+  ioping = no
+  ebpf = no
+  charts.d = no
+  apps = no
+  python.d = no
+  fping = no

k8s-state/conf/stream.conf

@@ -0,0 +1,8 @@
+[stream]
+  enabled = yes
+  destination = netdata:19999
+  api key = 11111111-2222-3333-4444-555555555555
+  timeout seconds = 60
+  buffer size bytes = 1048576
+  reconnect delay seconds = 5
+  initial clock resync iterations = 60

k8s-state/conf/x509check.yaml

@@ -0,0 +1,3 @@
+jobs:
+  - name: my_site_cert
+    source: https://gitea.tryton.geeraert.eu:443

k8s-state/deployment.yaml

@@ -0,0 +1,101 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: netdata-k8s-state
+  labels:
+    app: netdata
+    role: k8sState
+spec:
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: netdata
+      role: k8sState
+  template:
+    metadata:
+      annotations:
+        container.apparmor.security.beta.kubernetes.io/netdata: unconfined
+      labels:
+        app: netdata
+        role: k8sState
+    spec:
+      securityContext:
+        fsGroup: 201
+      serviceAccountName: netdata
+      restartPolicy: Always
+      containers:
+        - name: netdata
+          image: "netdata/netdata:edge"
+          imagePullPolicy: Always
+          env:
+            - name: MY_POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: MY_POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: NETDATA_LISTENER_PORT
+              value: '19999'
+          ports:
+            - name: http
+              containerPort: 19999
+              protocol: TCP
+          livenessProbe:
+            exec:
+              command: ["/usr/sbin/netdatacli", "ping"]
+            initialDelaySeconds: 0
+            failureThreshold: 3
+            periodSeconds: 30
+            successThreshold: 1
+            timeoutSeconds: 1
+          readinessProbe:
+            exec:
+              command: ["/usr/sbin/netdatacli", "ping"]
+            initialDelaySeconds: 0
+            failureThreshold: 3
+            periodSeconds: 30
+            successThreshold: 1
+            timeoutSeconds: 1
+          volumeMounts:
+            - name: os-release
+              mountPath: /host/etc/os-release
+            - name: configmap
+              mountPath: /etc/netdata/go.d.conf
+              subPath: go.d
+            - name: configmap
+              mountPath: /etc/netdata/go.d/httpcheck.conf
+              subPath: httpcheck
+            - name: configmap
+              mountPath: /etc/netdata/go.d/dns_query.conf
+              subPath: dnsquery
+            - name: configmap
+              mountPath: /etc/netdata/go.d/x509check.conf
+              subPath: x509check
+            - name: configmap
+              mountPath: /etc/netdata/go.d/k8s_state.conf
+              subPath: go.d-k8s_state
+            - name: configmap
+              mountPath: /etc/netdata/netdata.conf
+              subPath: netdata
+            - name: configmap
+              mountPath: /etc/netdata/stream.conf
+              subPath: stream
+            - name: varlib
+              mountPath: /var/lib/netdata
+          resources: {}
+      terminationGracePeriodSeconds: 30
+      volumes:
+        - name: os-release
+          hostPath:
+            path: /etc/os-release
+        - name: configmap
+          configMap:
+            name: netdata-conf-k8s-state
+            optional: true
+        - name: varlib
+          persistentVolumeClaim:
+            claimName: netdata-k8s-state-varlib
+      dnsPolicy: ClusterFirstWithHostNet

k8s-state/pvc.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: netdata-k8s-state-varlib
+  labels:
+    app: netdata
+    role: k8sState
+spec:
+  storageClassName: nfs-storage-intelligent
+  accessModes: ["ReadWriteOnce"]
+  resources:
+    requests:
+      storage: 1Gi

kustomization.yaml

@@ -0,0 +1,51 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: netdata
+
+resources:
+  - namespace.yaml
+  - rbac.yaml
+  - child/daemonset.yaml
+  - k8s-state/deployment.yaml
+  - k8s-state/pvc.yaml
+  - parent/deployment.yaml
+  - parent/service.yaml
+  - parent/pvc.yaml
+  - parent/ingress.yaml
+
+# configMapGenerator content-hashes each ConfigMap's name (e.g. netdata-conf-child-a1b2c3d4).
+# Kustomize automatically rewrites every Deployment/DaemonSet reference to the new hashed
+# name whenever any file below changes. Since the pod template's volume spec then differs,
+# Kubernetes rolls the pods automatically on `kubectl apply` — no manual checksum bump,
+# no manual `rollout restart`, ever again.
+configMapGenerator:
+  - name: netdata-conf-child
+    files:
+      - go.d=child/conf/go.d.yaml
+      - kubelet=child/conf/kubelet.yaml
+      - kubeproxy=child/conf/kubeproxy.yaml
+      - web_log=child/conf/web_log.yaml
+      - netdata=child/conf/netdata.conf
+      - stream=child/conf/stream.conf
+
+  - name: netdata-child-sd-config-map
+    files:
+      - config.yml=child/conf/sd-config.yml
+
+  - name: netdata-conf-k8s-state
+    files:
+      - go.d=k8s-state/conf/go.d.yaml
+      - go.d-k8s_state=k8s-state/conf/go.d-k8s_state.yaml
+      - netdata=k8s-state/conf/netdata.conf
+      - stream=k8s-state/conf/stream.conf
+      - httpcheck=k8s-state/conf/httpcheck.yaml
+      - dnsquery=k8s-state/conf/dnsquery.yaml
+      - x509check=k8s-state/conf/x509check.yaml
+
+  - name: netdata-conf-parent
+    files:
+      - health=parent/conf/health.conf
+      - netdata=parent/conf/netdata.conf
+      - stream=parent/conf/stream.conf
+      - otel=parent/conf/otel.yaml

namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: netdata

parent/conf/health.conf

@@ -0,0 +1,4 @@
+SEND_EMAIL="NO"
+SEND_SLACK="YES"
+SLACK_WEBHOOK_URL=""
+DEFAULT_RECIPIENT_SLACK=""

parent/conf/netdata.conf

@@ -0,0 +1,19 @@
+[global]
+  hostname = netdata-parent
+[db]
+  mode = dbengine
+
+[plugins]
+  cgroups = no
+  tc = no
+  enable running new plugins = no
+  check for new plugins every = 72000
+  python.d = no
+  charts.d = no
+  go.d = no
+  node.d = no
+  apps = no
+  proc = no
+  idlejitter = no
+  diskspace = no
+  otel = yes

parent/conf/otel.yaml

@@ -0,0 +1,26 @@
+# OpenTelemetry Plugin Configuration (otel.plugin)
+# Documented config surface only — see:
+# https://learn.netdata.cloud/docs/collecting-metrics/opentelemetry/opentelemetry-metrics
+#
+# Any field can also be overridden via NETDATA_OTEL_<FIELD> env vars
+# (dots -> underscores, e.g. endpoint.tls_cert_path -> NETDATA_OTEL_ENDPOINT_TLS_CERT_PATH).
+#
+# NOTE: fields like logs.rotation/retention, remote_storage, and auth appeared in an
+# earlier version of this config but are NOT present in the current documented schema.
+# Left out here rather than guessed — reintroduce only once confirmed against the
+# running agent version (e.g. via `otel.plugin --help` in the container, or Ask Nedi).
+
+endpoint:
+  # 0.0.0.0 so traffic arriving via the ClusterIP Service actually reaches the process
+  # (127.0.0.1 would only accept connections from inside the same network namespace).
+  path: "0.0.0.0:4317"
+  tls_cert_path: null
+  tls_key_path: null
+  tls_ca_cert_path: null
+
+metrics:
+  chart_configs_dir: /etc/netdata/otel.d/v1/metrics
+  interval_secs: 10
+  grace_period_secs: 60
+  expiry_duration_secs: 900
+  max_new_charts_per_request: 100

parent/conf/stream.conf

@@ -0,0 +1,6 @@
+[11111111-2222-3333-4444-555555555555]
+  enabled = yes
+  history = 3600
+  default memory mode = dbengine
+  health enabled by default = auto
+  allow from = *

parent/deployment.yaml

@@ -0,0 +1,107 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: netdata-parent
+  labels:
+    app: netdata
+    role: parent
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: netdata
+      role: parent
+  template:
+    metadata:
+      labels:
+        app: netdata
+        role: parent
+    spec:
+      securityContext:
+        fsGroup: 201
+      serviceAccountName: netdata
+      containers:
+        - name: netdata
+          image: "netdata/netdata:edge"
+          imagePullPolicy: Always
+          env:
+            - name: NETDATA_CLAIM_URL
+              value: "https://api.netdata.cloud"
+            - name: NETDATA_CLAIM_TOKEN
+              value: "CIlCwV6GawNWIfhrqMVmPAJixo_BSaGvwVbHKFOCQCHbYG5J8Ac0FDxKrObJ727F1dndg8J-v6apUhzGho6RIOlkrqJ_F7DKodjLqbsSWb7Ta-GSHkkuHcTXidxKxEo5RK0jiqU"
+            - name: NETDATA_CLAIM_ROOMS
+              value: "e15a4f12-89d7-4d5b-b588-6658fa835473"
+            - name: MY_POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: MY_POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: NETDATA_LISTENER_PORT
+              value: '19999'
+          ports:
+            - name: http
+              containerPort: 19999
+              protocol: TCP
+            - name: otel-grpc
+              containerPort: 4317
+              protocol: TCP
+          livenessProbe:
+            exec:
+              command: ["/usr/sbin/netdatacli", "ping"]
+            initialDelaySeconds: 0
+            failureThreshold: 3
+            periodSeconds: 30
+            successThreshold: 1
+            timeoutSeconds: 1
+          readinessProbe:
+            exec:
+              command: ["/usr/sbin/netdatacli", "ping"]
+            initialDelaySeconds: 0
+            failureThreshold: 3
+            periodSeconds: 30
+            successThreshold: 1
+            timeoutSeconds: 1
+          securityContext:
+            runAsUser: 201
+            runAsGroup: 201
+          volumeMounts:
+            - name: os-release
+              mountPath: /host/etc/os-release
+            - name: configmap
+              mountPath: /etc/netdata/health_alarm_notify.conf
+              subPath: health
+            - name: configmap
+              mountPath: /etc/netdata/netdata.conf
+              subPath: netdata
+            - name: configmap
+              mountPath: /etc/netdata/stream.conf
+              subPath: stream
+            - name: configmap
+              mountPath: /etc/netdata/otel.yaml
+              subPath: otel
+            - name: database
+              mountPath: /var/cache/netdata
+            - name: alarms
+              mountPath: /var/lib/netdata
+          resources: {}
+      terminationGracePeriodSeconds: 300
+      volumes:
+        - name: os-release
+          hostPath:
+            path: /etc/os-release
+        - name: configmap
+          configMap:
+            name: netdata-conf-parent
+            optional: true
+        - name: database
+          persistentVolumeClaim:
+            claimName: netdata-parent-database
+        - name: alarms
+          persistentVolumeClaim:
+            claimName: netdata-parent-alarms
+      dnsPolicy: Default

parent/ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: netdata
+  labels:
+    app: netdata
+  annotations:
+    kubernetes.io/ingress.class: nginx
+    kubernetes.io/tls-acme: "true"
+spec:
+  rules:
+    - host: netdata.k8s.local
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: netdata
+                port:
+                  name: http

parent/pvc.yaml

@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: netdata-parent-database
+  labels:
+    app: netdata
+    role: parent
+spec:
+  storageClassName: nfs-storage-intelligent
+  accessModes: ["ReadWriteOnce"]
+  resources:
+    requests:
+      storage: 15Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: netdata-parent-alarms
+  labels:
+    app: netdata
+    role: parent
+spec:
+  storageClassName: nfs-storage-intelligent
+  accessModes: ["ReadWriteOnce"]
+  resources:
+    requests:
+      storage: 1Gi

parent/service.yaml

@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: netdata
+  labels:
+    app: netdata
+    role: parent
+spec:
+  type: ClusterIP
+  ports:
+    - port: 19999
+      targetPort: http
+      protocol: TCP
+      name: http
+    - port: 4317
+      targetPort: otel-grpc
+      protocol: TCP
+      name: otel-grpc
+  selector:
+    app: netdata
+    role: parent

rbac.yaml

@@ -0,0 +1,48 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: netdata
+  labels:
+    app: netdata
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: netdata
+  labels:
+    app: netdata
+rules:
+  - apiGroups: [""]
+    resources:
+      - "pods"
+      - "services"
+      - "configmaps"
+      - "secrets"
+      - "nodes"
+      - "nodes/metrics"
+      - "nodes/proxy"
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: ["batch"]
+    resources: ["cronjobs", "jobs"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["namespaces"]
+    verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: netdata
+  labels:
+    app: netdata
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: netdata
+subjects:
+  - kind: ServiceAccount
+    name: netdata
+    namespace: netdata