feat(cert-checker): add Kubernetes resources for certificate checking functionality

- Implemented a new module for cert-checker with Kubernetes resources including ServiceAccount, Role, RoleBinding, ConfigMap, and CronJob. - Added Python script to check certificate expiry and restart deployments if necessary. - Configured environment variables for deployment name, namespace, and service details. - Included requirements for the Python environment. feat(devolo-exporter): introduce Devolo exporter for Prometheus metrics - Created a new module for Devolo exporter with Kubernetes resources including ServiceAccount, ConfigMap, Deployment, and Service. - Developed Python scripts to scrape metrics from Devolo devices and expose them to Prometheus. - Configured environment variables for Devolo device IP, model, and ports. - Added requirements for the Python environment.
2025-10-13 22:35:35 +02:00
parent 84c8288f8a
commit d069fe3585
25 changed files with 1362 additions and 33 deletions
@@ -0,0 +1,149 @@
+
+resource "kubernetes_service_account" "cert_checker" {
+  metadata {
+    name      = "cert-checker-sa"
+    namespace = var.namespace
+  }
+}
+
+resource "kubernetes_role" "cert_checker" {
+  metadata {
+    name = "cert-checker-role"
+  }
+  rule {
+    api_groups = ["apps"]
+    resources  = ["deployments"]
+    verbs      = ["get", "list", "patch", "update"]
+  }
+}
+
+resource "kubernetes_role_binding" "cert_checker_auth_reader" {
+  metadata {
+    name      = "cert-checker-biding"
+    namespace = var.namespace
+  }
+  role_ref {
+    api_group = "rbac.authorization.k8s.io"
+    kind      = "Role"
+    name      = "cert-checker-role"
+  }
+  subject {
+    kind      = "ServiceAccount"
+    name      = "cert-checker-sa"
+    namespace = var.namespace
+  }
+}
+
+resource "kubernetes_config_map" "cert_checker" {
+  metadata {
+    name      = "cert-checker-config"
+    namespace = var.namespace
+  }
+  data = {
+    "check.py"         = file("${path.module}/resources/check.py")
+    "requirements.txt" = file("${path.module}/resources/requirements.txt")
+  }
+}
+
+resource "kubernetes_cron_job_v1" "cert_checker" {
+  for_each = var.deployments
+  metadata {
+    name      = "cert-checker-${each.key}"
+    namespace = var.namespace
+    labels = {
+      app = "cert-checker"
+    }
+  }
+  spec {
+    schedule                      = coalesce(each.value.schedule, "0 0 * * *") # Default to daily at midnight
+    successful_jobs_history_limit = 2
+    failed_jobs_history_limit     = 1
+
+    job_template {
+      metadata {
+        name = "cert-checker"
+      }
+      spec {
+        backoff_limit = 1
+        parallelism   = 1
+        completions   = 1
+
+        template {
+          metadata {
+            labels = {
+              app = "cert-checker"
+            }
+          }
+          spec {
+            service_account_name = kubernetes_service_account.cert_checker.metadata[0].name
+            restart_policy       = "Never"
+            container {
+              name    = "cert-checker"
+              image   = var.tag
+              command = ["sh", "-c", join(" && ", local.commands)]
+              volume_mount {
+                name       = "config-volume"
+                mount_path = "/config"
+                read_only  = true
+              }
+              volume_mount {
+                name       = "cert-volume"
+                mount_path = "/certs"
+                read_only  = true
+              }
+              volume_mount {
+                name       = "workdir"
+                mount_path = "/tmp"
+              }
+              security_context {
+                run_as_user                = 1000
+                run_as_group               = 1000
+                allow_privilege_escalation = false
+                read_only_root_filesystem  = true
+                run_as_non_root            = true
+                capabilities {
+                  drop = ["ALL"]
+                }
+              }
+              env {
+                name  = "DEPLOYMENT_NAME"
+                value = each.key
+              }
+              env {
+                name  = "NAMESPACE"
+                value = var.namespace
+              }
+              env {
+                name  = "SERVICE_HOST"
+                value = "${each.value.service_name}.${var.namespace}.svc.cluster.local"
+              }
+              env {
+                name  = "SERVICE_PORT"
+                value = tostring(each.value.service_port)
+              }
+            }
+            volume {
+              name = "config-volume"
+              config_map {
+                name = kubernetes_config_map.cert_checker.metadata[0].name
+              }
+            }
+            volume {
+              name = "cert-volume"
+              secret {
+                secret_name = each.value.secret_name
+              }
+            }
+            volume {
+              name = "workdir"
+              host_path {
+                path = local.workdir
+                type = "DirectoryOrCreate"
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}