From 3ef83057161e6d973f79805340d4c3d210425465 Mon Sep 17 00:00:00 2001 From: Christian Pointner Date: Sun, 30 May 2021 16:08:03 +0200 Subject: cleanup: old preliminary tasks --- .../prometheus/exporter/base/tasks/main.yml | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) (limited to 'roles/monitoring/prometheus/exporter/base/tasks/main.yml') diff --git a/roles/monitoring/prometheus/exporter/base/tasks/main.yml b/roles/monitoring/prometheus/exporter/base/tasks/main.yml index c3a04bd9..7982f1f9 100644 --- a/roles/monitoring/prometheus/exporter/base/tasks/main.yml +++ b/roles/monitoring/prometheus/exporter/base/tasks/main.yml @@ -1,16 +1,15 @@ --- - name: create main configuration directories - loop: - - exporters-available - - exporters-enabled file: - path: "/etc/prometheus-exporter/{{ item }}" + path: "/etc/prometheus/exporters" state: directory -- name: install nginx vhost - vars: - nginx_vhost: - name: prometheus-exporter - content: "{{ lookup('template', 'nginx-vhost.conf.j2') }}" - include_role: - name: nginx/vhost +- name: install apt packages + apt: + name: prom-exporter-exporter + state: present + +## TODO: +## - systemd service unit +## - add snippet to exporter-exporter config-dir +## - create certificate/key -- cgit v1.2.3 From acfdc3ae8545177547fa75510cb9e56e0b909156 Mon Sep 17 00:00:00 2001 From: Christian Pointner Date: Sun, 30 May 2021 23:24:32 +0200 Subject: prometheus basic exporter base role --- chaos-at-home/ch-mon.yml | 1 + .../prometheus/exporter/base/defaults/main.yml | 2 +- .../prometheus/exporter/base/handlers/main.yml | 5 +++ .../prometheus/exporter/base/tasks/main.yml | 37 ++++++++++++++++++---- .../prometheus/exporter/base/templates/service.j2 | 31 ++++++++++++++++++ 5 files changed, 69 insertions(+), 7 deletions(-) create mode 100644 roles/monitoring/prometheus/exporter/base/handlers/main.yml create mode 100644 roles/monitoring/prometheus/exporter/base/templates/service.j2 (limited to 'roles/monitoring/prometheus/exporter/base/tasks/main.yml') diff --git a/chaos-at-home/ch-mon.yml b/chaos-at-home/ch-mon.yml index fb0eff53..b069bbf8 100644 --- a/chaos-at-home/ch-mon.yml +++ b/chaos-at-home/ch-mon.yml @@ -10,3 +10,4 @@ - role: storage/lvm/groups - role: apt-repo/spreadspace - role: monitoring/prometheus/server + - role: monitoring/prometheus/exporter/base diff --git a/roles/monitoring/prometheus/exporter/base/defaults/main.yml b/roles/monitoring/prometheus/exporter/base/defaults/main.yml index 5f8ce103..963763a5 100644 --- a/roles/monitoring/prometheus/exporter/base/defaults/main.yml +++ b/roles/monitoring/prometheus/exporter/base/defaults/main.yml @@ -1,2 +1,2 @@ --- -prometheus_exporter_port: 9000 +prometheus_exporter_listen: ":9999" diff --git a/roles/monitoring/prometheus/exporter/base/handlers/main.yml b/roles/monitoring/prometheus/exporter/base/handlers/main.yml new file mode 100644 index 00000000..ebd760cf --- /dev/null +++ b/roles/monitoring/prometheus/exporter/base/handlers/main.yml @@ -0,0 +1,5 @@ +--- +- name: restart prometheus-exporter-exporter + service: + name: prometheus-exporter-exporter + state: restarted diff --git a/roles/monitoring/prometheus/exporter/base/tasks/main.yml b/roles/monitoring/prometheus/exporter/base/tasks/main.yml index 7982f1f9..fab6ff7b 100644 --- a/roles/monitoring/prometheus/exporter/base/tasks/main.yml +++ b/roles/monitoring/prometheus/exporter/base/tasks/main.yml @@ -1,15 +1,40 @@ --- -- name: create main configuration directories - file: - path: "/etc/prometheus/exporters" - state: directory +- name: check if prometheus apt component of spreadspace repo is enabled + assert: + msg: "please enable the 'prometheus' component of spreadspace repo using 'spreadspace_apt_repo_components'" + that: + - spreadspace_apt_repo_components is defined + - "'prometheus' in spreadspace_apt_repo_components" - name: install apt packages apt: name: prom-exporter-exporter state: present +- name: create configuration directories + file: + path: /etc/prometheus/exporter/enabled + state: directory + +- name: add user for prometheus-exporter + user: + name: prometheus-exporter + system: yes + home: /nonexistent + create_home: no + ## TODO: -## - systemd service unit -## - add snippet to exporter-exporter config-dir ## - create certificate/key + +- name: generate systemd service unit + template: + src: service.j2 + dest: /etc/systemd/system/prometheus-exporter-exporter.service + notify: restart prometheus-exporter-exporter + +- name: make sure prometheus-exporter-exporter is enabled and started + systemd: + name: prometheus-exporter-exporter.service + daemon_reload: yes + state: started + enabled: yes diff --git a/roles/monitoring/prometheus/exporter/base/templates/service.j2 b/roles/monitoring/prometheus/exporter/base/templates/service.j2 new file mode 100644 index 00000000..6069fc79 --- /dev/null +++ b/roles/monitoring/prometheus/exporter/base/templates/service.j2 @@ -0,0 +1,31 @@ +[Unit] +Description=Prometheus exporter proxy + +[Service] +Restart=always +User=prometheus-exporter +ExecStart=/usr/bin/prometheus-exporter-exporter --config.dirs=/etc/prometheus/exporter/enabled --config.file="" --web.listen-address="{{ prometheus_exporter_listen }}" + +# systemd hardening-options +AmbientCapabilities= +CapabilityBoundingSet= +DeviceAllow=/dev/null rw +DevicePolicy=strict +LockPersonality=true +MemoryDenyWriteExecute=true +NoNewPrivileges=true +PrivateDevices=true +PrivateTmp=true +PrivateUsers=true +ProtectControlGroups=true +ProtectHome=true +ProtectKernelModules=true +ProtectKernelTunables=true +ProtectSystem=strict +RemoveIPC=true +RestrictNamespaces=true +RestrictRealtime=true +SystemCallArchitectures=native + +[Install] +WantedBy=multi-user.target -- cgit v1.2.3 From 96232fb34906f9efd98189838141d896668d3dd8 Mon Sep 17 00:00:00 2001 From: Christian Pointner Date: Wed, 2 Jun 2021 02:25:33 +0200 Subject: prometheus: preliminary tls support for exporter connections --- .../prometheus/exporter/base/tasks/main.yml | 4 +- .../prometheus/exporter/base/tasks/tls.yml | 61 ++++++++++++++++++++++ .../prometheus/exporter/base/templates/service.j2 | 2 +- .../prometheus/server/templates/prometheus.yml.j2 | 7 +++ 4 files changed, 71 insertions(+), 3 deletions(-) create mode 100644 roles/monitoring/prometheus/exporter/base/tasks/tls.yml (limited to 'roles/monitoring/prometheus/exporter/base/tasks/main.yml') diff --git a/roles/monitoring/prometheus/exporter/base/tasks/main.yml b/roles/monitoring/prometheus/exporter/base/tasks/main.yml index fab6ff7b..9a214f39 100644 --- a/roles/monitoring/prometheus/exporter/base/tasks/main.yml +++ b/roles/monitoring/prometheus/exporter/base/tasks/main.yml @@ -23,8 +23,8 @@ home: /nonexistent create_home: no -## TODO: -## - create certificate/key +- name: create TLS certificate and key + import_tasks: tls.yml - name: generate systemd service unit template: diff --git a/roles/monitoring/prometheus/exporter/base/tasks/tls.yml b/roles/monitoring/prometheus/exporter/base/tasks/tls.yml new file mode 100644 index 00000000..b2731b09 --- /dev/null +++ b/roles/monitoring/prometheus/exporter/base/tasks/tls.yml @@ -0,0 +1,61 @@ +--- +- name: install python-cryptoraphy + apt: + name: "{{ python_basename }}-cryptography" + state: present + +- name: create base directory + file: + path: /etc/ssl/prometheus + state: directory + +- name: create exporter cert/key directory + file: + path: /etc/ssl/prometheus/exporter + state: directory + owner: root + group: prometheus-exporter + mode: 0750 + +- name: create exporter private key + openssl_privatekey: + path: /etc/ssl/prometheus/exporter/key.pem + type: RSA + size: 4096 + owner: prometheus-exporter + group: prometheus-exporter + mode: 0400 + notify: restart prometheus-exporter-exporter + +- name: create signing request for exporter certificate + openssl_csr: + path: /etc/ssl/prometheus/exporter/csr.pem + privatekey_path: /etc/ssl/prometheus/exporter/key.pem + CN: "{{ inventory_hostname }}" + subject_alt_name: + - "DNS:{{ host_name }}.{{ host_domain }}" + - "IP:{{ ansible_default_ipv4.address }}" + key_usage: + - digitalSignature + key_usage_critical: yes + extended_key_usage: + - serverAuth + extended_key_usage_critical: yes + basic_constraints: + - 'CA:FALSE' + basic_constraints_critical: yes + +## TODO: implement remote singing using server + +- name: create exporter certificate + openssl_certificate: + path: /etc/ssl/prometheus/exporter/crt.pem + csr_path: /etc/ssl/prometheus/exporter/csr.pem + provider: ownca + ownca_path: /etc/ssl/prometheus/ca-crt.pem + ownca_privatekey_path: /etc/ssl/prometheus/ca/key.pem + ownca_digest: sha256 + ownca_not_after: "+18250d" ## 50 years + notify: restart prometheus-exporter-exporter + +## TODO: install /etc/ssl/prometheus/ca-crt.pem from server diff --git a/roles/monitoring/prometheus/exporter/base/templates/service.j2 b/roles/monitoring/prometheus/exporter/base/templates/service.j2 index e2c54d6c..c24baf43 100644 --- a/roles/monitoring/prometheus/exporter/base/templates/service.j2 +++ b/roles/monitoring/prometheus/exporter/base/templates/service.j2 @@ -4,7 +4,7 @@ Description=Prometheus exporter proxy [Service] Restart=always User=prometheus-exporter -ExecStart=/usr/bin/prometheus-exporter-exporter --config.dirs=/etc/prometheus/exporter/enabled --config.file="" --web.listen-address="{{ prometheus_exporter_listen }}" +ExecStart=/usr/bin/prometheus-exporter-exporter -config.dirs=/etc/prometheus/exporter/enabled -config.file="" -web.listen-address="" -web.tls.listen-address="{{ prometheus_exporter_listen }}" -web.tls.cert="/etc/ssl/prometheus/exporter/crt.pem" -web.tls.key="/etc/ssl/prometheus/exporter/key.pem" --web.tls.ca="/etc/ssl/prometheus/ca-crt.pem" -web.tls.verify {# TODO: implement reloading once the exporter_exporter supports this #} # systemd hardening-options diff --git a/roles/monitoring/prometheus/server/templates/prometheus.yml.j2 b/roles/monitoring/prometheus/server/templates/prometheus.yml.j2 index 007afa90..e94ea043 100644 --- a/roles/monitoring/prometheus/server/templates/prometheus.yml.j2 +++ b/roles/monitoring/prometheus/server/templates/prometheus.yml.j2 @@ -9,6 +9,8 @@ scrape_configs: - job_name: 'prometheus' static_configs: - targets: ['localhost:9090'] + labels: + instance: "{{ inventory_hostname }}" {% for job in prometheus_server_jobs %} - job_name: '{{ job }}' @@ -16,6 +18,11 @@ scrape_configs: params: module: - {{ job }} + scheme: https + tls_config: + ca_file: /etc/ssl/prometheus/ca-crt.pem + cert_file: /etc/ssl/prometheus/server/exporter-crt.pem + key_file: /etc/ssl/prometheus/server/exporter-key.pem file_sd_configs: - files: - "/etc/prometheus/jobs/{{ job }}/*.yml" -- cgit v1.2.3