chore(deps): update helm release prometheus to v29

- Cap retention at 7d / 6GB so WAL cannot fill the 8Gi PV
- Raise kyverno/traefik scrape interval 15s -> 60s
- Drop request-duration histogram buckets and go_*/process_* runtime
  metrics from both jobs

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.tofu/platforms/eks/dev/providers.tf

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 5.0"
+      version = "~> 6.0"
     }
     tls = {
       source  = "hashicorp/tls"

.tofu/platforms/eks/modules/cluster/providers.tf

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 5.0"
+      version = "~> 6.0"
     }
     tls = {
       source  = "hashicorp/tls"

.tofu/platforms/eks/prod/providers.tf

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 5.0"
+      version = "~> 6.0"
     }
     tls = {
       source  = "hashicorp/tls"

.tofu/platforms/eks/workload/providers.tf

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     aws = {
       source  = "hashicorp/aws"
-      version = "~> 5.0"
+      version = "~> 6.0"
     }
     tls = {
       source  = "hashicorp/tls"

infra/base/prometheus/prometheus.yaml

@@ -17,7 +17,7 @@ spec:
   sources:
   - repoURL: https://prometheus-community.github.io/helm-charts
     chart: prometheus
-    targetRevision: "28.16.0"
+    targetRevision: "29.35.0"
     helm:
       releaseName: prometheus
       valueFiles:

infra/base/traefik-application/traefik-application.yaml

@@ -24,7 +24,7 @@ spec:
   sources:
   - repoURL: https://traefik.github.io/charts
     chart: traefik
-    targetRevision: "28.3.0"
+    targetRevision: "41.6.0"
     helm:
       releaseName: traefik
       valueFiles:

infra/values/base/opencost-values.yaml

@@ -4,14 +4,17 @@ opencost:
     extraEnv:
       EMIT_KSM_V1_METRICS: "false"
       EMIT_KSM_V1_METRICS_ONLY: "true"
-    prometheus:
-      internal:
-        enabled: true
-        serviceName: prometheus-server
-        namespaceName: monitoring
-        port: 80
     # Cloud-specific pricing is in per-cluster value overrides
     # (e.g. infra/values/upc-dev/opencost-values.yaml)
+  # NOTE: `prometheus` is a sibling of `exporter` under `opencost` in the
+  # chart's values schema - nesting it inside `exporter` silently falls back
+  # to the chart default namespace (prometheus-system).
+  prometheus:
+    internal:
+      enabled: true
+      serviceName: prometheus-server
+      namespaceName: monitoring
+      port: 80
   ui:
     enabled: false
 service:

infra/values/base/prometheus-values.yaml

@@ -4,6 +4,12 @@ server:
   service:
     servicePort: 80
 
+  strategy:
+    type: Recreate
+
+  retention: 7d
+  retentionSize: 6GB
+
   resources:
     requests:
       cpu: 150m
@@ -18,7 +24,7 @@ server:
 
 extraScrapeConfigs: |
   - job_name: kyverno
-    scrape_interval: 15s
+    scrape_interval: 60s
     metrics_path: /metrics
     kubernetes_sd_configs:
       - role: endpoints
@@ -35,9 +41,16 @@ extraScrapeConfigs: |
         target_label: pod
       - source_labels: [__meta_kubernetes_namespace]
         target_label: namespace
+    metric_relabel_configs:
+      - source_labels: [__name__]
+        regex: 'kyverno_(http_requests_duration_seconds|controller_.+_duration_seconds|admission_review_duration_seconds)_bucket'
+        action: drop
+      - source_labels: [__name__]
+        regex: 'go_.*|process_.*'
+        action: drop
 
   - job_name: traefik
-    scrape_interval: 15s
+    scrape_interval: 60s
     metrics_path: /metrics
     kubernetes_sd_configs:
       - role: endpoints
@@ -54,6 +67,13 @@ extraScrapeConfigs: |
         target_label: pod
       - source_labels: [__meta_kubernetes_namespace]
         target_label: namespace
+    metric_relabel_configs:
+      - source_labels: [__name__]
+        regex: 'traefik_(router|service|entrypoint)_request_duration_seconds_bucket'
+        action: drop
+      - source_labels: [__name__]
+        regex: 'go_.*|process_.*'
+        action: drop
 
 alertmanager:
   enabled: false