nixos/manifests/monitoring/deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: prometheus
  labels:
    app: prometheus
spec:
  replicas: 1
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
    type: RollingUpdate
  selector:
    matchLabels:
      app: prometheus
  template:
    metadata:
      labels:
        app: prometheus
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "9090"
    spec:
      serviceAccountName: prometheus
      containers:
        - name: prometheus
          image: prom/prometheus
          args:
            - "--storage.tsdb.path=/prometheus"
            - "--config.file=/etc/prometheus/prometheus.yml"
          ports:
            - name: http
              containerPort: 9090
          volumeMounts:
            - name: prometheus-config-values
              mountPath: /etc/prometheus/prometheus.yml
              subPath: prometheus.yml
            - name: prometheus-alerts
              mountPath: /etc/prometheus/alerts.yml
              subPath: alerts.yml
            - name: prometheus-storage-volume
              mountPath: /prometheus
            - name: restic-credentials
              mountPath: /etc/prometheus/secrets/restic
              readOnly: true
      restartPolicy: Always
      volumes:
        - name: prometheus-config-values
          configMap:
            defaultMode: 420
            name: prometheus-config
        - name: prometheus-alerts
          configMap:
            defaultMode: 420
            name: prometheus-alerts
        - name: prometheus-storage-volume
          persistentVolumeClaim:
            claimName: prometheus-data
        - name: restic-credentials
          secret:
            secretName: restic-credentials