Add Node Exporter and Fail2Ban Exporter modules: implement Kubernetes resources and Prometheus scrape configurations

terraform/modules/utils/fail2ban-exporter/config.tf

@@ -0,0 +1,4 @@
+locals {
+  app_version = var.tag
+  namespace   = var.namespace
+}

terraform/modules/utils/fail2ban-exporter/main.tf

@@ -0,0 +1,96 @@
+resource "kubernetes_service_account" "fail2ban_exporter" {
+  metadata {
+    name      = "fail2ban-exporter"
+    namespace = local.namespace
+    labels = {
+      k8s-app = "fail2ban-exporter"
+    }
+  }
+  automount_service_account_token = false
+}
+
+resource "kubernetes_deployment" "fail2ban_exporter" {
+  metadata {
+    name      = "fail2ban-exporter"
+    namespace = local.namespace
+    labels = {
+      k8s-app = "fail2ban-exporter"
+    }
+  }
+  spec {
+    selector {
+      match_labels = {
+        k8s-app = "fail2ban-exporter"
+      }
+    }
+    strategy {
+      type = "RollingUpdate"
+    }
+    template {
+      metadata {
+        labels = {
+          k8s-app = "fail2ban-exporter"
+        }
+      }
+      spec {
+        service_account_name            = "fail2ban-exporter"
+        automount_service_account_token = false
+        container {
+          name              = "fail2ban-exporter"
+          image             = "registry.gitlab.com/hctrdev/fail2ban-prometheus-exporter:${local.app_version}"
+          image_pull_policy = "IfNotPresent"
+          port {
+            container_port = 9191
+            name           = "http"
+            protocol       = "TCP"
+          }
+          security_context {
+            read_only_root_filesystem = true
+          }
+          volume_mount {
+            name       = "tmp-dir"
+            mount_path = "/tmp"
+          }
+          volume_mount {
+            name       = "fail2ban-run"
+            mount_path = "/var/run/fail2ban"
+            read_only  = true
+          }
+        }
+        volume {
+          name = "tmp-dir"
+          empty_dir {}
+        }
+        volume {
+          name = "fail2ban-run"
+          host_path {
+            path = "/var/run/fail2ban"
+            type = "Directory"
+          }
+        }
+      }
+    }
+  }
+}
+
+resource "kubernetes_service" "fail2ban_exporter" {
+  metadata {
+    name      = "fail2ban-exporter"
+    namespace = local.namespace
+    labels = {
+      k8s-app = "fail2ban-exporter"
+    }
+  }
+  spec {
+    selector = {
+      k8s-app = "fail2ban-exporter"
+    }
+    port {
+      name        = "http"
+      port        = 9100
+      target_port = 9191
+      protocol    = "TCP"
+    }
+    type = "ClusterIP"
+  }
+}

terraform/modules/utils/fail2ban-exporter/provider.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_version = "~>1.8"
+  required_providers {
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = "2.36.0"
+    }
+  }
+}

terraform/modules/utils/fail2ban-exporter/variables.tf

@@ -0,0 +1,11 @@
+variable "tag" {
+  description = "Fail2Ban exporter image tag"
+  type        = string
+  default     = "latest"
+}
+
+variable "namespace" {
+  description = "Kubernetes namespace to deploy the Fail2Ban exporter"
+  type        = string
+  default     = "kube-system"
+}