From acfdc3ae8545177547fa75510cb9e56e0b909156 Mon Sep 17 00:00:00 2001 From: Christian Pointner Date: Sun, 30 May 2021 23:24:32 +0200 Subject: prometheus basic exporter base role --- .../prometheus/exporter/base/templates/service.j2 | 31 ++++++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 roles/monitoring/prometheus/exporter/base/templates/service.j2 (limited to 'roles/monitoring/prometheus/exporter/base/templates/service.j2') diff --git a/roles/monitoring/prometheus/exporter/base/templates/service.j2 b/roles/monitoring/prometheus/exporter/base/templates/service.j2 new file mode 100644 index 00000000..6069fc79 --- /dev/null +++ b/roles/monitoring/prometheus/exporter/base/templates/service.j2 @@ -0,0 +1,31 @@ +[Unit] +Description=Prometheus exporter proxy + +[Service] +Restart=always +User=prometheus-exporter +ExecStart=/usr/bin/prometheus-exporter-exporter --config.dirs=/etc/prometheus/exporter/enabled --config.file="" --web.listen-address="{{ prometheus_exporter_listen }}" + +# systemd hardening-options +AmbientCapabilities= +CapabilityBoundingSet= +DeviceAllow=/dev/null rw +DevicePolicy=strict +LockPersonality=true +MemoryDenyWriteExecute=true +NoNewPrivileges=true +PrivateDevices=true +PrivateTmp=true +PrivateUsers=true +ProtectControlGroups=true +ProtectHome=true +ProtectKernelModules=true +ProtectKernelTunables=true +ProtectSystem=strict +RemoveIPC=true +RestrictNamespaces=true +RestrictRealtime=true +SystemCallArchitectures=native + +[Install] +WantedBy=multi-user.target -- cgit v1.2.3 From 35fb88969a6cb85d8ba7541820acf3b0ff891055 Mon Sep 17 00:00:00 2001 From: Christian Pointner Date: Mon, 31 May 2021 22:41:50 +0200 Subject: prometheus: initial node exporter role --- chaos-at-home/ch-mon.yml | 1 + .../prometheus/exporter/base/templates/service.j2 | 1 + .../prometheus/exporter/node/defaults/main.yml | 5 +++ .../prometheus/exporter/node/handlers/main.yml | 6 ++++ .../prometheus/exporter/node/tasks/main.yml | 36 ++++++++++++++++++++-- .../prometheus/exporter/node/templates/service.j2 | 10 ++++++ 6 files changed, 56 insertions(+), 3 deletions(-) create mode 100644 roles/monitoring/prometheus/exporter/node/defaults/main.yml create mode 100644 roles/monitoring/prometheus/exporter/node/templates/service.j2 (limited to 'roles/monitoring/prometheus/exporter/base/templates/service.j2') diff --git a/chaos-at-home/ch-mon.yml b/chaos-at-home/ch-mon.yml index b069bbf8..2cb69484 100644 --- a/chaos-at-home/ch-mon.yml +++ b/chaos-at-home/ch-mon.yml @@ -11,3 +11,4 @@ - role: apt-repo/spreadspace - role: monitoring/prometheus/server - role: monitoring/prometheus/exporter/base + - role: monitoring/prometheus/exporter/node diff --git a/roles/monitoring/prometheus/exporter/base/templates/service.j2 b/roles/monitoring/prometheus/exporter/base/templates/service.j2 index 6069fc79..e2c54d6c 100644 --- a/roles/monitoring/prometheus/exporter/base/templates/service.j2 +++ b/roles/monitoring/prometheus/exporter/base/templates/service.j2 @@ -5,6 +5,7 @@ Description=Prometheus exporter proxy Restart=always User=prometheus-exporter ExecStart=/usr/bin/prometheus-exporter-exporter --config.dirs=/etc/prometheus/exporter/enabled --config.file="" --web.listen-address="{{ prometheus_exporter_listen }}" +{# TODO: implement reloading once the exporter_exporter supports this #} # systemd hardening-options AmbientCapabilities= diff --git a/roles/monitoring/prometheus/exporter/node/defaults/main.yml b/roles/monitoring/prometheus/exporter/node/defaults/main.yml new file mode 100644 index 00000000..5eff7844 --- /dev/null +++ b/roles/monitoring/prometheus/exporter/node/defaults/main.yml @@ -0,0 +1,5 @@ +--- +prometheus_exporter_node_disable_collectors: [] + +prometheus_exporter_node_extra_collectors: +- ntp diff --git a/roles/monitoring/prometheus/exporter/node/handlers/main.yml b/roles/monitoring/prometheus/exporter/node/handlers/main.yml index 9c62baf6..3e1b2000 100644 --- a/roles/monitoring/prometheus/exporter/node/handlers/main.yml +++ b/roles/monitoring/prometheus/exporter/node/handlers/main.yml @@ -3,3 +3,9 @@ service: name: prometheus-node-exporter state: restarted + +- name: reload prometheus-exporter-exporter + service: + name: prometheus-exporter-exporter + ## TODO: implement reload once exporter_exporter supports this... + state: restarted diff --git a/roles/monitoring/prometheus/exporter/node/tasks/main.yml b/roles/monitoring/prometheus/exporter/node/tasks/main.yml index 0758eb3f..694dafb0 100644 --- a/roles/monitoring/prometheus/exporter/node/tasks/main.yml +++ b/roles/monitoring/prometheus/exporter/node/tasks/main.yml @@ -1,9 +1,39 @@ --- +- name: check if prometheus apt component of spreadspace repo is enabled + assert: + msg: "please enable the 'prometheus' component of spreadspace repo using 'spreadspace_apt_repo_components'" + that: + - spreadspace_apt_repo_components is defined + - "'prometheus' in spreadspace_apt_repo_components" + - name: install apt packages apt: name: prom-exporter-node state: present -## TODO: -## - systemd service unit -## - add snippet to exporter-exporter config-dir +- name: create directory for textfile collector + file: + path: /var/lib/prometheus-node-exporter/textfile-collector + state: directory + +- name: generate systemd service unit + template: + src: service.j2 + dest: /etc/systemd/system/prometheus-node-exporter.service + notify: restart prometheus-node-exporter + +- name: make sure prometheus-exporter-exporter is enabled and started + systemd: + name: prometheus-node-exporter.service + daemon_reload: yes + state: started + enabled: yes + +- name: register exporter + copy: + content: | + method: http + http: + port: 9100 + dest: /etc/prometheus/exporter/enabled/node.yml + notify: reload prometheus-exporter-exporter diff --git a/roles/monitoring/prometheus/exporter/node/templates/service.j2 b/roles/monitoring/prometheus/exporter/node/templates/service.j2 new file mode 100644 index 00000000..c3b46472 --- /dev/null +++ b/roles/monitoring/prometheus/exporter/node/templates/service.j2 @@ -0,0 +1,10 @@ +[Unit] +Description=Prometheus exporter + +[Service] +Restart=always +User=prometheus-exporter +ExecStart=/usr/bin/prometheus-node-exporter --web.listen-address="127.0.0.1:9100" --web.disable-exporter-metrics --collector.textfile.directory="/var/lib/prometheus-node-exporter/textfile-collector" {% for collector in prometheus_exporter_node_disable_collectors %} --no-collector.{{ collector }}{% endfor %}{% for collector in prometheus_exporter_node_extra_collectors %} --collector.{{ collector }}{% endfor %}{{ '' }} + +[Install] +WantedBy=multi-user.target -- cgit v1.2.3 From 96232fb34906f9efd98189838141d896668d3dd8 Mon Sep 17 00:00:00 2001 From: Christian Pointner Date: Wed, 2 Jun 2021 02:25:33 +0200 Subject: prometheus: preliminary tls support for exporter connections --- .../prometheus/exporter/base/tasks/main.yml | 4 +- .../prometheus/exporter/base/tasks/tls.yml | 61 ++++++++++++++++++++++ .../prometheus/exporter/base/templates/service.j2 | 2 +- .../prometheus/server/templates/prometheus.yml.j2 | 7 +++ 4 files changed, 71 insertions(+), 3 deletions(-) create mode 100644 roles/monitoring/prometheus/exporter/base/tasks/tls.yml (limited to 'roles/monitoring/prometheus/exporter/base/templates/service.j2') diff --git a/roles/monitoring/prometheus/exporter/base/tasks/main.yml b/roles/monitoring/prometheus/exporter/base/tasks/main.yml index fab6ff7b..9a214f39 100644 --- a/roles/monitoring/prometheus/exporter/base/tasks/main.yml +++ b/roles/monitoring/prometheus/exporter/base/tasks/main.yml @@ -23,8 +23,8 @@ home: /nonexistent create_home: no -## TODO: -## - create certificate/key +- name: create TLS certificate and key + import_tasks: tls.yml - name: generate systemd service unit template: diff --git a/roles/monitoring/prometheus/exporter/base/tasks/tls.yml b/roles/monitoring/prometheus/exporter/base/tasks/tls.yml new file mode 100644 index 00000000..b2731b09 --- /dev/null +++ b/roles/monitoring/prometheus/exporter/base/tasks/tls.yml @@ -0,0 +1,61 @@ +--- +- name: install python-cryptoraphy + apt: + name: "{{ python_basename }}-cryptography" + state: present + +- name: create base directory + file: + path: /etc/ssl/prometheus + state: directory + +- name: create exporter cert/key directory + file: + path: /etc/ssl/prometheus/exporter + state: directory + owner: root + group: prometheus-exporter + mode: 0750 + +- name: create exporter private key + openssl_privatekey: + path: /etc/ssl/prometheus/exporter/key.pem + type: RSA + size: 4096 + owner: prometheus-exporter + group: prometheus-exporter + mode: 0400 + notify: restart prometheus-exporter-exporter + +- name: create signing request for exporter certificate + openssl_csr: + path: /etc/ssl/prometheus/exporter/csr.pem + privatekey_path: /etc/ssl/prometheus/exporter/key.pem + CN: "{{ inventory_hostname }}" + subject_alt_name: + - "DNS:{{ host_name }}.{{ host_domain }}" + - "IP:{{ ansible_default_ipv4.address }}" + key_usage: + - digitalSignature + key_usage_critical: yes + extended_key_usage: + - serverAuth + extended_key_usage_critical: yes + basic_constraints: + - 'CA:FALSE' + basic_constraints_critical: yes + +## TODO: implement remote singing using server + +- name: create exporter certificate + openssl_certificate: + path: /etc/ssl/prometheus/exporter/crt.pem + csr_path: /etc/ssl/prometheus/exporter/csr.pem + provider: ownca + ownca_path: /etc/ssl/prometheus/ca-crt.pem + ownca_privatekey_path: /etc/ssl/prometheus/ca/key.pem + ownca_digest: sha256 + ownca_not_after: "+18250d" ## 50 years + notify: restart prometheus-exporter-exporter + +## TODO: install /etc/ssl/prometheus/ca-crt.pem from server diff --git a/roles/monitoring/prometheus/exporter/base/templates/service.j2 b/roles/monitoring/prometheus/exporter/base/templates/service.j2 index e2c54d6c..c24baf43 100644 --- a/roles/monitoring/prometheus/exporter/base/templates/service.j2 +++ b/roles/monitoring/prometheus/exporter/base/templates/service.j2 @@ -4,7 +4,7 @@ Description=Prometheus exporter proxy [Service] Restart=always User=prometheus-exporter -ExecStart=/usr/bin/prometheus-exporter-exporter --config.dirs=/etc/prometheus/exporter/enabled --config.file="" --web.listen-address="{{ prometheus_exporter_listen }}" +ExecStart=/usr/bin/prometheus-exporter-exporter -config.dirs=/etc/prometheus/exporter/enabled -config.file="" -web.listen-address="" -web.tls.listen-address="{{ prometheus_exporter_listen }}" -web.tls.cert="/etc/ssl/prometheus/exporter/crt.pem" -web.tls.key="/etc/ssl/prometheus/exporter/key.pem" --web.tls.ca="/etc/ssl/prometheus/ca-crt.pem" -web.tls.verify {# TODO: implement reloading once the exporter_exporter supports this #} # systemd hardening-options diff --git a/roles/monitoring/prometheus/server/templates/prometheus.yml.j2 b/roles/monitoring/prometheus/server/templates/prometheus.yml.j2 index 007afa90..e94ea043 100644 --- a/roles/monitoring/prometheus/server/templates/prometheus.yml.j2 +++ b/roles/monitoring/prometheus/server/templates/prometheus.yml.j2 @@ -9,6 +9,8 @@ scrape_configs: - job_name: 'prometheus' static_configs: - targets: ['localhost:9090'] + labels: + instance: "{{ inventory_hostname }}" {% for job in prometheus_server_jobs %} - job_name: '{{ job }}' @@ -16,6 +18,11 @@ scrape_configs: params: module: - {{ job }} + scheme: https + tls_config: + ca_file: /etc/ssl/prometheus/ca-crt.pem + cert_file: /etc/ssl/prometheus/server/exporter-crt.pem + key_file: /etc/ssl/prometheus/server/exporter-key.pem file_sd_configs: - files: - "/etc/prometheus/jobs/{{ job }}/*.yml" -- cgit v1.2.3