Everything we watch — stored and surfaced.

One self-hosted kube-prometheus-stack per region replaces poll-only SolarWinds; hosts, network and Azure in one place across three regions.

Regions EU·BR·CN

~2,000

Monitored elements

Licences (was $120–250k)

15→scrape

min poll, gone

The stack

Exporters feed an HA Prometheus pair that fans out to alerting, dashboards and long-term storage.

Layer	Component	Role
Metrics core	`Prometheus` (HA pair)	scrape, store, alert rules
Alerting	`Alertmanager`	dedup, route by owner, silence
Dashboards	`Grafana` (OSS)	Entra-ID SSO, per-team folders
Hosts	`node_exporter`	CPU/mem/disk/net on VMs + on-prem
Network	`snmp_exporter` + `blackbox_exporter`	SNMP + HTTP/TCP/ICMP probes
Azure	`azure-metrics-exporter`	Azure Monitor per subscription
Kubernetes	`kube-state-metrics` + `cAdvisor`	cluster + workload health
Long-term	`Thanos` / remote-write	retention beyond local TSDB

Each region runs its own full stack; residency and isolation rules differ by jurisdiction.

Full stack; primary. May hold a read-only Thanos view of Brazil aggregates.

Full stack; metrics stay in-region. Only non-sensitive aggregates leave.

Fully isolated full stack, own Grafana + identity. NO cross-border scraping or querying, ever.

A parallel-run migration that never leaves us blind.

Stand the stack up alongside SolarWinds → roll out exporters via Ansible/AWX → confirm parity → cut over per service → decommission SolarWinds last.

Kills the licence: $120–250k/yr recovered.
First-class coverage: K8s, Azure and network as native targets vs 15-min polling.
Runbook links survive: alert names kept as <service>-<severity>-<symptom>.
ADR realised: new single-zone workload alert realises ADR-0001.

Note: all cost figures are documented ranges, [validate with finance].

Source architecture, residency notes and the decision records behind the stack.

Neighbouring sections of the workspace.