SYS.DOCS // DOCS

Deploy and Operate Prometheus Stack

kube-prometheus-stack is the prometheus-community chart that installs Prometheus, Grafana, Alertmanager, and the Prometheus Operator as one release. Edka deploys it into the monitoring namespace of your Kubernetes cluster, wires it to the node-exporter add-on, and publishes the three web interfaces on the traffic class you select.

Architecture

Component	Purpose	How Edka connects it
Prometheus	Metric collection, storage, and rule evaluation	One replica from the chart, `30s` scrape and evaluation interval, `15d` retention
Grafana	Dashboards and the default Prometheus datasource	Same chart release, default dashboards and provisioning sidecars enabled
Alertmanager	Alert grouping, routing, inhibition, and silences	Same chart release, one replica, `120h` retention
Prometheus Operator	Manages the Prometheus, Alertmanager, ServiceMonitor, and rule resources	Same chart release
kube-state-metrics	Kubernetes object metrics	Enabled by Workload Metrics
node-exporter	Host and OS metrics	Edka’s node-exporter add-on in `monitoring`, scraped by an additional scrape config
cert-manager	TLS certificates for the exposed hostnames	Required add-on, referenced through the Cluster Issuer Name
Ingress or Gateway	External access to Grafana, Prometheus, and Alertmanager	Select an Ingress Class; Envoy Gateway classes are published as `HTTPRoute` resources

The chart’s bundled node-exporter subchart stays disabled. Node metrics come from Edka’s standalone add-on instead, so a single node-exporter DaemonSet serves both the app and the rest of the platform.

Prerequisites

Before installing the stack, prepare:

an Edka cluster with a storage class for the Prometheus and Grafana volumes
DNS hostnames for each interface you plan to expose
an ingress class or an Envoy Gateway traffic class with managed TLS

Edka installs the app’s four required add-ons when they are missing: metrics-server, cert-manager, letsencrypt-issuer, and node-exporter. See Kubernetes Add-ons Management, Gateway API, and Domains and TLS.

Install Prometheus Stack

Open your cluster and select Apps.
Find kube-prometheus-stack and select Install.
In Monitoring, confirm the kube-prometheus-stack Chart Version and choose which scrape scopes to enable.
In Grafana, set the Admin Password and decide whether anonymous viewing is allowed.
In Alerting, keep Enable Alerting on and add Slack details if you want notifications at install time.
In Storage, size the Prometheus and Grafana volumes and confirm the Storage Class.
In Access, select the Ingress Class and the hostnames for the interfaces you want to expose.
Select Install App and follow the operation progress until the stack is ready.

The namespace is fixed: the template creates and targets monitoring.

Monitoring Scope

All four scrape scopes are on by default.

Setting	Default	Effect
Kubernetes Components	on	Scrapes the API server, kubelet, and CoreDNS
Node Metrics	on	Scrapes the node-exporter add-on and enables the node and node-exporter rules
Workload Metrics	on	Enables kube-state-metrics for pod, deployment, and object metrics
Automatic Service Discovery	on	Selects every ServiceMonitor, PodMonitor, and PrometheusRule in the cluster

With Automatic Service Discovery disabled, the chart’s default selectors apply and Prometheus only picks up monitor and rule objects that carry this release’s Helm labels.

The node-exporter scrape job targets the node-exporter-prometheus-node-exporter service in the monitoring namespace on its metrics port, and relabels the node, namespace, and service labels onto the samples.

kube-dns, etcd, kube-scheduler, and kube-proxy component scraping stays off.

Grafana Access

Grafana ships with the chart’s default dashboards, a UTC default timezone, and Prometheus provisioned as the default datasource. The dashboard sidecar watches all namespaces for ConfigMaps labeled grafana_dashboard, so you can add your own dashboards without changing the app configuration.

Setting	Default	Notes
Enable Authentication	on	Requires login to reach Grafana
Admin Password	none	Required, generated on request in the browser
Allow Anonymous Viewing	off	Read-only access without login

The admin user name is admin. Use the generate control next to Admin Password to create a 16-character password, and store it in your own password manager: Edka does not return the stored value in the app configuration view after installation. During a configuration update, leave Admin Password empty to keep the current password.

Alerting and Slack Notifications

Enable Alerting is on by default and deploys Alertmanager with the chart’s default configuration. Slack Notifications is off by default. Enabling it requires a Slack Webhook URL and a Slack Channel, which defaults to #alerts.

With Slack enabled, Edka renders an Alertmanager configuration that:

groups alerts by namespace, alertname, and severity
waits 10s before the first notification, 5m between grouped updates, and 12h before repeating
sends critical and warning alerts to the configured channel, including resolved notifications
routes the Watchdog alert to a null receiver
suppresses warning and info alerts while a critical alert is firing for the same namespace and alert name, and info while a warning is firing

Default Rules

The chart’s default alerting and recording rules are created. Active groups include Alertmanager, general, Kubernetes apps, resources, storage, and system, container CPU and memory recording rules, pod owner and container resource rules, API server availability, burn rate, histogram, and SLO rules, kubelet, kube-state-metrics, network, Prometheus, and Prometheus Operator.

The node, node-exporter alerting, node-exporter recording, and node recording groups follow the Node Metrics setting.

etcd, controller manager, kube-proxy, kube-scheduler, and Windows rule groups are disabled.

Storage and Retention

Setting	Default	Options
Enable Persistent Storage	on	Prometheus writes to a persistent volume
Prometheus Storage Size	`20Gi`	`10Gi`, `20Gi`, `50Gi`, `100Gi`, `200Gi`, `500Gi`
Persist Grafana Configuration	on	Keeps dashboards and settings on restart
Grafana Storage Size	`10Gi`	`10Gi`
Storage Class	`hcloud-volumes`	Storage classes available in the cluster

Storage Class cannot be changed after provisioning. Both volumes are ReadWriteOnce.

Prometheus keeps 15d of data and Alertmanager keeps 120h. Alertmanager runs without a persistent volume, so silences and notification state do not survive a pod restart.

The Prometheus volume claim uses whenDeleted: Delete and whenScaled: Retain, so removing the Prometheus resource, including uninstalling the app, deletes the metrics volume.

Resources

Component	Requests	Limits
Prometheus	`100m` / `512Mi`	`500m` / `2Gi`
Grafana	`50m` / `64Mi`	`200m` / `256Mi`
Alertmanager	`10m` / `32Mi`	`100m` / `128Mi`
Prometheus Operator	`50m` / `64Mi`	`200m` / `256Mi`

Prometheus and Alertmanager each run a single replica.

External Access

Every interface is private by default. Expose Prometheus, Expose Grafana, and Expose AlertManager are off, and each one requires the matching Prometheus Hostname, Grafana Hostname, or AlertManager Hostname when enabled.

Ingress Class defaults to eg and lists the ingress controllers and traffic classes available in the cluster. Use Cluster Issuer to request TLS Certificates is on and uses the Cluster Issuer Name, which defaults to letsencrypt-http from the letsencrypt-issuer add-on. Clearing the checkbox falls back to the ingress controller’s default certificate.

How Edka publishes the interfaces depends on the class you select:

Envoy Gateway traffic class: Edka disables the chart’s own Ingress objects and creates HTTPRoute resources named kube-prometheus-stack-grafana, kube-prometheus-stack-prometheus, and kube-prometheus-stack-alertmanager in monitoring, targeting service ports 80, 9090, and 9093. TLS is terminated at the Gateway listener.
Tailscale class: Edka creates Tailscale Ingress resources and turns the cluster issuer off, because Tailscale issues its own certificates.
Any other ingress class: the chart creates Ingress objects annotated with the cert-manager cluster issuer and the grafana-tls, prometheus-tls, and alertmanager-tls Secrets.

After installation, Edka shows the external URLs for the interfaces you exposed, plus the internal service endpoints in the monitoring namespace:

kube-prometheus-stack-grafana.monitoring.svc.cluster.local:80
kube-prometheus-stack-prometheus.monitoring.svc.cluster.local:9090
kube-prometheus-stack-alertmanager.monitoring.svc.cluster.local:9093

Edka also lists the retention and storage allocation, and the Slack channel when Slack notifications are enabled.

Chart Version and Updates

kube-prometheus-stack Chart Version defaults to 65.1.1 and stays editable after installation. Change it and apply the configuration to move the release to another chart version. This template does not expose auto-update options, so chart upgrades are always explicit.

Troubleshooting

Symptom	Check
Node dashboards and node alerts are empty	Enable Node Metrics and confirm the `node-exporter-prometheus-node-exporter` service is running in `monitoring`
A ServiceMonitor or PodMonitor is ignored	Enable Automatic Service Discovery, otherwise only objects labeled by this release are selected
An interface is unreachable externally	Confirm the matching Expose toggle is on and the hostname resolves through the selected Ingress Class
The certificate is not issued	Confirm the `cert-manager` and `letsencrypt-issuer` add-ons are installed and Cluster Issuer Name matches a ClusterIssuer
Slack alerts do not arrive	Both Enable Alerting and Slack Notifications must be on; only `critical` and `warning` route to Slack, and `Watchdog` is dropped
The Grafana admin password is lost	It cannot be revealed after installation; set a new Admin Password and apply the configuration
The Prometheus pod stays pending	Confirm the selected Storage Class can provision a volume of the chosen Prometheus Storage Size
Silences disappear after a restart	Alertmanager runs without a persistent volume
Control plane alerts are missing	etcd, controller manager, kube-proxy, and kube-scheduler rules and scrape targets are disabled