Add custom error pages and Nginx configuration for proxy module
- Introduced custom HTML error pages for various HTTP status codes (400, 401, 403, 404, 408, 429, 500, 502, 503, 504) in the proxy module. - Created a .gitignore file to exclude non-HTML files in the error resources directory. - Updated Nginx configuration to serve custom error pages for upstream errors. - Added new Nginx configuration templates for handling HTTP and stream protocols. - Implemented Wireguard configuration templates and associated variables for secure connections. - Established Kubernetes resources for Stunnel and Wireguard, including deployment, service accounts, and config maps. - Defined variables for the Stunnel and Wireguard modules to facilitate configuration. - Created a new Wol Proxy module with Kubernetes resources for deployment and service management.
This commit is contained in:
@@ -0,0 +1,17 @@
|
||||
locals {
|
||||
app_version = var.tag
|
||||
data_folder = "${var.persistent_folder}/prometheus"
|
||||
|
||||
prometheus_config = coalesce(var.config, file("${path.module}/resources/default.yml"))
|
||||
prometheus_config_checksum = md5(local.prometheus_config)
|
||||
|
||||
prometheus_rules = yamlencode({
|
||||
groups = [
|
||||
{
|
||||
name = "custom-rules"
|
||||
rules = var.rules
|
||||
}
|
||||
]
|
||||
})
|
||||
prometheus_rules_checksum = md5(local.prometheus_rules)
|
||||
}
|
||||
@@ -0,0 +1,5 @@
|
||||
resource "kubernetes_namespace" "monitoring" {
|
||||
metadata {
|
||||
name = "prometheus"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,216 @@
|
||||
resource "kubernetes_service_account" "prometheus" {
|
||||
metadata {
|
||||
name = "prometheus"
|
||||
namespace = kubernetes_namespace.monitoring.metadata[0].name
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_cluster_role" "prometheus" {
|
||||
metadata {
|
||||
name = "prometheus"
|
||||
}
|
||||
|
||||
rule {
|
||||
api_groups = [""]
|
||||
resources = ["nodes", "nodes/proxy", "services", "endpoints", "pods"]
|
||||
verbs = ["get", "list", "watch"]
|
||||
}
|
||||
|
||||
rule {
|
||||
api_groups = ["extensions"]
|
||||
resources = ["ingresses"]
|
||||
verbs = ["get", "list", "watch"]
|
||||
}
|
||||
|
||||
rule {
|
||||
api_groups = ["networking.k8s.io"]
|
||||
resources = ["ingresses"]
|
||||
verbs = ["get", "list", "watch"]
|
||||
}
|
||||
|
||||
rule {
|
||||
non_resource_urls = ["/metrics"]
|
||||
verbs = ["get"]
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_cluster_role_binding" "prometheus" {
|
||||
metadata {
|
||||
name = "prometheus"
|
||||
}
|
||||
|
||||
role_ref {
|
||||
api_group = "rbac.authorization.k8s.io"
|
||||
kind = "ClusterRole"
|
||||
name = kubernetes_cluster_role.prometheus.metadata[0].name
|
||||
}
|
||||
|
||||
subject {
|
||||
kind = "ServiceAccount"
|
||||
name = kubernetes_service_account.prometheus.metadata[0].name
|
||||
namespace = kubernetes_namespace.monitoring.metadata[0].name
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_config_map" "prometheus" {
|
||||
metadata {
|
||||
name = "prometheus-server-conf"
|
||||
namespace = kubernetes_namespace.monitoring.metadata[0].name
|
||||
labels = {
|
||||
name = "prometheus-server-conf"
|
||||
}
|
||||
}
|
||||
|
||||
data = {
|
||||
"prometheus.rules" = local.prometheus_rules
|
||||
"prometheus.yml" = local.prometheus_config
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_deployment" "prometheus" {
|
||||
metadata {
|
||||
name = "prometheus"
|
||||
namespace = kubernetes_namespace.monitoring.metadata[0].name
|
||||
labels = {
|
||||
app = "prometheus"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
replicas = 1
|
||||
strategy {
|
||||
type = "Recreate"
|
||||
}
|
||||
|
||||
selector {
|
||||
match_labels = {
|
||||
app = "prometheus"
|
||||
}
|
||||
}
|
||||
|
||||
template {
|
||||
|
||||
metadata {
|
||||
labels = {
|
||||
app = "prometheus"
|
||||
}
|
||||
annotations = {
|
||||
"checksum/config" = local.prometheus_config_checksum
|
||||
"checksum/rules" = local.prometheus_rules_checksum
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
service_account_name = kubernetes_service_account.prometheus.metadata[0].name
|
||||
container {
|
||||
name = "prometheus"
|
||||
image = "prom/prometheus:${local.app_version}"
|
||||
args = [
|
||||
"--config.file=/etc/prometheus/prometheus.yml",
|
||||
"--storage.tsdb.path=/prometheus/",
|
||||
"--storage.tsdb.retention.time=${var.retention_time}",
|
||||
]
|
||||
|
||||
port {
|
||||
name = "http-prometheus"
|
||||
container_port = 9090
|
||||
}
|
||||
|
||||
security_context {
|
||||
run_as_user = 1000
|
||||
run_as_group = 1000
|
||||
run_as_non_root = true
|
||||
allow_privilege_escalation = false
|
||||
}
|
||||
|
||||
volume_mount {
|
||||
name = "prometheus-config-volume"
|
||||
mount_path = "/etc/prometheus/"
|
||||
}
|
||||
volume_mount {
|
||||
name = "prometheus-storage-volume"
|
||||
mount_path = "/prometheus"
|
||||
}
|
||||
}
|
||||
|
||||
volume {
|
||||
name = "prometheus-config-volume"
|
||||
config_map {
|
||||
name = kubernetes_config_map.prometheus.metadata[0].name
|
||||
}
|
||||
}
|
||||
|
||||
volume {
|
||||
name = "prometheus-storage-volume"
|
||||
host_path {
|
||||
path = local.data_folder
|
||||
type = "DirectoryOrCreate"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_service" "prometheus" {
|
||||
metadata {
|
||||
name = "prometheus"
|
||||
namespace = kubernetes_namespace.monitoring.metadata[0].name
|
||||
annotations = {
|
||||
"prometheus.io/scrape" = "true"
|
||||
"prometheus.io/port" = "9090"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
selector = {
|
||||
app = "prometheus"
|
||||
}
|
||||
|
||||
type = "ClusterIP"
|
||||
|
||||
port {
|
||||
port = 9090
|
||||
protocol = "TCP"
|
||||
target_port = "http-prometheus"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# resource "kubernetes_ingress_v1" "prometheus" {
|
||||
# metadata {
|
||||
# name = "prometheus-ui"
|
||||
# namespace = kubernetes_namespace.monitoring.metadata[0].name
|
||||
# annotations = {
|
||||
# "kubernetes.io/ingress.class" = var.ingress_class
|
||||
# }
|
||||
# }
|
||||
|
||||
# spec {
|
||||
# rule {
|
||||
# host = var.fqdn
|
||||
# http {
|
||||
# path {
|
||||
# path = "/"
|
||||
# path_type = "Prefix"
|
||||
# backend {
|
||||
# service {
|
||||
# name = kubernetes_service.prometheus.metadata[0].name
|
||||
# port {
|
||||
# number = 8080
|
||||
# }
|
||||
# }
|
||||
# }
|
||||
# }
|
||||
# }
|
||||
# }
|
||||
|
||||
# dynamic "tls" {
|
||||
# for_each = local.tls_crt_data != "" && local.tls_key_data != "" ? [1] : []
|
||||
# content {
|
||||
# hosts = [var.fqdn]
|
||||
# secret_name = local.tls_secret_name
|
||||
# }
|
||||
# }
|
||||
# }
|
||||
# }
|
||||
@@ -0,0 +1,9 @@
|
||||
terraform {
|
||||
required_version = "~>1.8"
|
||||
required_providers {
|
||||
kubernetes = {
|
||||
source = "hashicorp/kubernetes"
|
||||
version = "2.36.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,38 @@
|
||||
global:
|
||||
scrape_interval: 5s
|
||||
evaluation_interval: 5s
|
||||
rule_files:
|
||||
- /etc/prometheus/prometheus.rules
|
||||
scrape_configs:
|
||||
- job_name: kubernetes-nodes-cadvisor
|
||||
scrape_interval: 10s
|
||||
scrape_timeout: 10s
|
||||
scheme: https # remove if you want to scrape metrics on insecure port
|
||||
tls_config:
|
||||
ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
||||
insecure_skip_verify: true
|
||||
bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
|
||||
kubernetes_sd_configs:
|
||||
- role: node
|
||||
relabel_configs:
|
||||
- action: labelmap
|
||||
regex: __meta_kubernetes_node_label_(.+)
|
||||
# Only for Kubernetes ^1.7.3.
|
||||
# See: https://github.com/prometheus/prometheus/issues/2916
|
||||
- target_label: __address__
|
||||
replacement: kubernetes.default.svc:443
|
||||
- source_labels: [__meta_kubernetes_node_name]
|
||||
regex: (.+)
|
||||
target_label: __metrics_path__
|
||||
replacement: /api/v1/nodes/${1}/proxy/metrics/cadvisor
|
||||
metric_relabel_configs:
|
||||
- action: replace
|
||||
source_labels: [id]
|
||||
regex: '^/machine\.slice/machine-rkt\\x2d([^\\]+)\\.+/([^/]+)\.service$'
|
||||
target_label: rkt_container_name
|
||||
replacement: "${2}-${1}"
|
||||
- action: replace
|
||||
source_labels: [id]
|
||||
regex: '^/system\.slice/(.+)\.service$'
|
||||
target_label: systemd_service_name
|
||||
replacement: "${1}"
|
||||
@@ -0,0 +1,126 @@
|
||||
global:
|
||||
scrape_interval: 5s
|
||||
evaluation_interval: 5s
|
||||
rule_files:
|
||||
- /etc/prometheus/prometheus.rules
|
||||
alerting:
|
||||
alertmanagers:
|
||||
- scheme: http
|
||||
static_configs:
|
||||
- targets:
|
||||
- "alertmanager.monitoring.svc:9093"
|
||||
scrape_configs:
|
||||
- job_name: "node-exporter"
|
||||
kubernetes_sd_configs:
|
||||
- role: endpoints
|
||||
relabel_configs:
|
||||
- source_labels: [__meta_kubernetes_endpoints_name]
|
||||
regex: "node-exporter"
|
||||
action: keep
|
||||
- job_name: "kubernetes-apiservers"
|
||||
kubernetes_sd_configs:
|
||||
- role: endpoints
|
||||
scheme: https
|
||||
tls_config:
|
||||
ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
||||
bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
|
||||
relabel_configs:
|
||||
- source_labels:
|
||||
[
|
||||
__meta_kubernetes_namespace,
|
||||
__meta_kubernetes_service_name,
|
||||
__meta_kubernetes_endpoint_port_name,
|
||||
]
|
||||
action: keep
|
||||
regex: default;kubernetes;https
|
||||
- job_name: "kubernetes-nodes"
|
||||
scheme: https
|
||||
tls_config:
|
||||
ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
||||
bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
|
||||
kubernetes_sd_configs:
|
||||
- role: node
|
||||
relabel_configs:
|
||||
- action: labelmap
|
||||
regex: __meta_kubernetes_node_label_(.+)
|
||||
- target_label: __address__
|
||||
replacement: kubernetes.default.svc:443
|
||||
- source_labels: [__meta_kubernetes_node_name]
|
||||
regex: (.+)
|
||||
target_label: __metrics_path__
|
||||
replacement: /api/v1/nodes/$${1}/proxy/metrics
|
||||
- job_name: "kubernetes-pods"
|
||||
kubernetes_sd_configs:
|
||||
- role: pod
|
||||
relabel_configs:
|
||||
- source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
|
||||
action: keep
|
||||
regex: true
|
||||
- source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path]
|
||||
action: replace
|
||||
target_label: __metrics_path__
|
||||
regex: (.+)
|
||||
- source_labels:
|
||||
[__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
|
||||
action: replace
|
||||
regex: ([^:]+)(?::\d+)?;(\d+)
|
||||
replacement: $1:$2
|
||||
target_label: __address__
|
||||
- action: labelmap
|
||||
regex: __meta_kubernetes_pod_label_(.+)
|
||||
- source_labels: [__meta_kubernetes_namespace]
|
||||
action: replace
|
||||
target_label: kubernetes_namespace
|
||||
- source_labels: [__meta_kubernetes_pod_name]
|
||||
action: replace
|
||||
target_label: kubernetes_pod_name
|
||||
- job_name: "kube-state-metrics"
|
||||
static_configs:
|
||||
- targets: ["kube-state-metrics.kube-system.svc.cluster.local:8080"]
|
||||
- job_name: "kubernetes-cadvisor"
|
||||
scheme: https
|
||||
tls_config:
|
||||
ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
||||
bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
|
||||
kubernetes_sd_configs:
|
||||
- role: node
|
||||
relabel_configs:
|
||||
- action: labelmap
|
||||
regex: __meta_kubernetes_node_label_(.+)
|
||||
- target_label: __address__
|
||||
replacement: kubernetes.default.svc:443
|
||||
- source_labels: [__meta_kubernetes_node_name]
|
||||
regex: (.+)
|
||||
target_label: __metrics_path__
|
||||
replacement: /api/v1/nodes/$${1}/proxy/metrics/cadvisor
|
||||
- job_name: "kubernetes-service-endpoints"
|
||||
kubernetes_sd_configs:
|
||||
- role: endpoints
|
||||
relabel_configs:
|
||||
- source_labels:
|
||||
[__meta_kubernetes_service_annotation_prometheus_io_scrape]
|
||||
action: keep
|
||||
regex: true
|
||||
- source_labels:
|
||||
[__meta_kubernetes_service_annotation_prometheus_io_scheme]
|
||||
action: replace
|
||||
target_label: __scheme__
|
||||
regex: (https?)
|
||||
- source_labels: [__meta_kubernetes_service_annotation_prometheus_io_path]
|
||||
action: replace
|
||||
target_label: __metrics_path__
|
||||
regex: (.+)
|
||||
- source_labels:
|
||||
[__address__, __meta_kubernetes_service_annotation_prometheus_io_port]
|
||||
action: replace
|
||||
target_label: __address__
|
||||
regex: ([^:]+)(?::\d+)?;(\d+)
|
||||
replacement: $1:$2
|
||||
- action: labelmap
|
||||
regex: __meta_kubernetes_service_label_(.+)
|
||||
- source_labels: [__meta_kubernetes_namespace]
|
||||
action: replace
|
||||
target_label: kubernetes_namespace
|
||||
- source_labels: [__meta_kubernetes_service_name]
|
||||
action: replace
|
||||
target_label: kubernetes_name
|
||||
@@ -0,0 +1,34 @@
|
||||
variable "tag" {
|
||||
description = "Prometheus image tag"
|
||||
type = string
|
||||
default = "latest"
|
||||
}
|
||||
|
||||
variable "retention_time" {
|
||||
description = "Prometheus data retention time"
|
||||
type = string
|
||||
default = "15d"
|
||||
}
|
||||
|
||||
variable "rules" {
|
||||
description = "Prometheus alerting rules"
|
||||
type = list(object({
|
||||
alert = string
|
||||
expr = string
|
||||
for = string
|
||||
labels = map(string)
|
||||
annotations = map(string)
|
||||
}))
|
||||
default = []
|
||||
}
|
||||
|
||||
variable "config" {
|
||||
description = "Custom Prometheus configuration in YAML format"
|
||||
type = string
|
||||
default = ""
|
||||
}
|
||||
|
||||
variable "persistent_folder" {
|
||||
description = "The path to the persistent folder"
|
||||
type = string
|
||||
}
|
||||
Reference in New Issue
Block a user