Decision
ArgoCD app-of-apps
over many independent app manifests
One root application manages the rest, so the whole stack installs (and uninstalls) as a single, ordered unit.
GitOps · Kubernetes
Monitoring Stack
Production monitoring as code — a 20-panel Grafana dashboard and 7 alert rules, every object declared in Git and deployed by ArgoCD.
20Grafana panels
7alert rules
5services monitored
- ArgoCD
- External Secrets
- cert-manager
- kube-prometheus-stack
- Loki + Promtail
A monitoring setup you can rebuild from scratch
Click-configured dashboards and hand-installed exporters drift the moment you look away, and they’re impossible to reproduce. I wanted the whole observability stack — dashboards, alerts, secrets, TLS — to be a Git repo I could apply to an empty cluster.
That meant solving the boring-but-critical parts properly: where secrets come from, how certificates are issued, and how updates roll out without manual steps.
App-of-apps, secrets, TLS, then the stack
ArgoCD’s app-of-apps pattern owns everything; External Secrets pulls credentials from Azure Key Vault; cert-manager issues TLS; and kube-prometheus-stack plus Loki provide the signals.
GitOps
ArgoCD app-of-apps
Secrets
External SecretsAzure Key Vault
TLS
cert-managerLet’s Encrypt
Metrics
kube-prometheus-stackGrafana
Logs
Loki + Promtail
What I chose, and why
Decision
External Secrets + Key Vault
over secrets committed to Git
Credentials stay in Azure Key Vault and are synced in at runtime — GitOps without leaking secrets into the repo.
Decision
cert-manager automation
over manual certificate renewal
Let’s Encrypt certs issue and renew themselves, so TLS never silently expires.
The results
20Dashboard panels
7Alert rules
5Services
7dLog retention