From 88a48ac987453fe789eb8e502214485d4cb62d9d Mon Sep 17 00:00:00 2001
From: Marco van Zijl <marco@mvzijl.nl>
Date: Sun, 17 May 2026 11:59:01 +0200
Subject: [PATCH] Add Talos-compatible Metrics Server addon

---
 apps/metrics-server/Chart.yaml       | 11 +++++++++++
 apps/metrics-server/README.md        | 21 ++++++++++++++++++++
 apps/metrics-server/application.yaml | 29 ++++++++++++++++++++++++++++
 apps/metrics-server/values.yaml      | 25 ++++++++++++++++++++++++
 4 files changed, 86 insertions(+)
 create mode 100644 apps/metrics-server/Chart.yaml
 create mode 100644 apps/metrics-server/README.md
 create mode 100644 apps/metrics-server/application.yaml
 create mode 100644 apps/metrics-server/values.yaml

diff --git a/apps/metrics-server/Chart.yaml b/apps/metrics-server/Chart.yaml
new file mode 100644
index 0000000..b95341d
--- /dev/null
+++ b/apps/metrics-server/Chart.yaml
@@ -0,0 +1,11 @@
+apiVersion: v2
+name: metrics-server
+description: Kubernetes Metrics Server wrapper chart
+type: application
+version: 1.0.0
+appVersion: "0.8.0"
+
+dependencies:
+  - name: metrics-server
+    version: 3.13.0
+    repository: https://kubernetes-sigs.github.io/metrics-server/
diff --git a/apps/metrics-server/README.md b/apps/metrics-server/README.md
new file mode 100644
index 0000000..2f1e568
--- /dev/null
+++ b/apps/metrics-server/README.md
@@ -0,0 +1,21 @@
+# Metrics Server
+
+Metrics Server provides the Kubernetes Metrics API for live resource usage,
+including `kubectl top` and future HPA/VPA resource metrics.
+
+It is intentionally small and not scraped by Prometheus. Prometheus/Grafana
+remain the source for historical dashboards and alerting.
+
+Talos kubelets use serving certificates that are not trusted by metrics-server
+unless kubelet server certificate rotation and CSR approval are configured.
+This deployment uses `--kubelet-insecure-tls` so it works with the current
+Talos configuration.
+
+After syncing, verify:
+
+```bash
+kubectl -n kube-system get deploy metrics-server
+kubectl get apiservice v1beta1.metrics.k8s.io
+kubectl top nodes
+kubectl top pods -n litellm
+```
diff --git a/apps/metrics-server/application.yaml b/apps/metrics-server/application.yaml
new file mode 100644
index 0000000..373df80
--- /dev/null
+++ b/apps/metrics-server/application.yaml
@@ -0,0 +1,29 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: metrics-server
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "-4"
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://git.mvzijl.nl/marco/veda.git
+    targetRevision: applicationset-rewrite
+    path: apps/metrics-server
+    helm:
+      releaseName: metrics-server
+      valueFiles:
+        - values.yaml
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: kube-system
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=false
+      - ServerSideApply=true
diff --git a/apps/metrics-server/values.yaml b/apps/metrics-server/values.yaml
new file mode 100644
index 0000000..0f2a9b5
--- /dev/null
+++ b/apps/metrics-server/values.yaml
@@ -0,0 +1,25 @@
+metrics-server:
+  replicas: 1
+
+  defaultArgs:
+    - --cert-dir=/tmp
+    - --kubelet-preferred-address-types=InternalIP,Hostname,ExternalIP
+    - --kubelet-use-node-status-port
+    - --kubelet-insecure-tls
+    - --metric-resolution=15s
+
+  podDisruptionBudget:
+    enabled: false
+
+  metrics:
+    enabled: false
+
+  serviceMonitor:
+    enabled: false
+
+  resources:
+    requests:
+      cpu: 25m
+      memory: 64Mi
+    limits:
+      memory: 128Mi