From 09ecd5ba78d76b4d172fa2e24b84adb7247aeff0 Mon Sep 17 00:00:00 2001
From: Felix Wolf <felix.wolf@blueworld-gmbh.de>
Date: Sat, 4 Apr 2026 15:06:36 +0200
Subject: [PATCH] feat: Add kubelet and cAdvisor scrape jobs

Enables direct scraping of kubelet and cAdvisor metrics from Kubernetes nodes.
This provides more granular insights into node health and container resource utilization.
Configures secure HTTPS scraping using Kubernetes node service discovery.
---
 .../helm/victoria-metrics-single.yaml         | 25 +++++++++++++++++++
 ...ia-metrics-single-server-scrapeconfig.yaml | 25 +++++++++++++++++++
 2 files changed, 50 insertions(+)

diff --git a/prototypes/victoria-metrics-single/helm/victoria-metrics-single.yaml b/prototypes/victoria-metrics-single/helm/victoria-metrics-single.yaml
index a98b50a..ba50d3f 100644
--- a/prototypes/victoria-metrics-single/helm/victoria-metrics-single.yaml
+++ b/prototypes/victoria-metrics-single/helm/victoria-metrics-single.yaml
@@ -16,6 +16,8 @@ server:
       global:
         scrape_interval: 30s
         scrape_timeout: 10s
+        external_labels:
+          cluster: k8s-and-chill
       scrape_configs:
         - job_name: victoriametrics
           static_configs:
@@ -34,6 +36,29 @@ server:
             - source_labels: [__meta_kubernetes_namespace, __meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
               action: keep
               regex: monitoring;kube-state-metrics;http
+        - job_name: kubelet
+          kubernetes_sd_configs:
+            - role: node
+          scheme: https
+          tls_config:
+            ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+            insecure_skip_verify: true
+          bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+          relabel_configs:
+            - action: labelmap
+              regex: __meta_kubernetes_node_label_(.+)
+        - job_name: kubelet-cadvisor
+          kubernetes_sd_configs:
+            - role: node
+          scheme: https
+          tls_config:
+            ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+            insecure_skip_verify: true
+          bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+          metrics_path: /metrics/cadvisor
+          relabel_configs:
+            - action: labelmap
+              regex: __meta_kubernetes_node_label_(.+)
         - job_name: traefik
           kubernetes_sd_configs:
             - role: endpoints
diff --git a/rendered/envs/production/victoria-metrics-single/configmap-victoria-metrics-single-server-scrapeconfig.yaml b/rendered/envs/production/victoria-metrics-single/configmap-victoria-metrics-single-server-scrapeconfig.yaml
index f572963..f059655 100644
--- a/rendered/envs/production/victoria-metrics-single/configmap-victoria-metrics-single-server-scrapeconfig.yaml
+++ b/rendered/envs/production/victoria-metrics-single/configmap-victoria-metrics-single-server-scrapeconfig.yaml
@@ -2,6 +2,8 @@ apiVersion: v1
 data:
   scrape.yml: |
     global:
+      external_labels:
+        cluster: k8s-and-chill
       scrape_interval: 30s
       scrape_timeout: 10s
     scrape_configs:
@@ -29,6 +31,29 @@ data:
         - __meta_kubernetes_namespace
         - __meta_kubernetes_service_name
         - __meta_kubernetes_endpoint_port_name
+    - bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+      job_name: kubelet
+      kubernetes_sd_configs:
+      - role: node
+      relabel_configs:
+      - action: labelmap
+        regex: __meta_kubernetes_node_label_(.+)
+      scheme: https
+      tls_config:
+        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+        insecure_skip_verify: true
+    - bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+      job_name: kubelet-cadvisor
+      kubernetes_sd_configs:
+      - role: node
+      metrics_path: /metrics/cadvisor
+      relabel_configs:
+      - action: labelmap
+        regex: __meta_kubernetes_node_label_(.+)
+      scheme: https
+      tls_config:
+        ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+        insecure_skip_verify: true
     - job_name: traefik
       kubernetes_sd_configs:
       - role: endpoints