a13labs.infra/terraform/modules/utils/prometheus/prometheus.tf

resource "kubernetes_service_account" "prometheus" {
  metadata {
    name      = "prometheus"
    namespace = kubernetes_namespace.prometheus.metadata[0].name
  }
}

resource "kubernetes_cluster_role" "prometheus" {
  metadata {
    name = "prometheus"
  }

  rule {
    api_groups = [""]
    resources  = ["nodes", "nodes/proxy", "services", "endpoints", "pods"]
    verbs      = ["get", "list", "watch"]
  }

  rule {
    api_groups = ["extensions"]
    resources  = ["ingresses"]
    verbs      = ["get", "list", "watch"]
  }

  rule {
    api_groups = ["networking.k8s.io"]
    resources  = ["ingresses"]
    verbs      = ["get", "list", "watch"]
  }

  rule {
    non_resource_urls = ["/metrics"]
    verbs             = ["get"]
  }
}

resource "kubernetes_cluster_role_binding" "prometheus" {
  metadata {
    name = "prometheus"
  }

  role_ref {
    api_group = "rbac.authorization.k8s.io"
    kind      = "ClusterRole"
    name      = kubernetes_cluster_role.prometheus.metadata[0].name
  }

  subject {
    kind      = "ServiceAccount"
    name      = kubernetes_service_account.prometheus.metadata[0].name
    namespace = kubernetes_namespace.prometheus.metadata[0].name
  }
}

resource "kubernetes_config_map" "prometheus" {
  metadata {
    name      = "prometheus-server-conf"
    namespace = kubernetes_namespace.prometheus.metadata[0].name
    labels = {
      name = "prometheus-server-conf"
    }
  }

  data = {
    "prometheus.rules" = local.prometheus_rules
    "prometheus.yml"   = local.prometheus_config
  }
}

resource "kubernetes_deployment" "prometheus" {
  metadata {
    name      = "prometheus"
    namespace = kubernetes_namespace.prometheus.metadata[0].name
    labels = {
      app = "prometheus"
    }
  }

  spec {
    replicas = 1
    strategy {
      type = "Recreate"
    }

    selector {
      match_labels = {
        app = "prometheus"
      }
    }

    template {

      metadata {
        labels = {
          app = "prometheus"
        }
        annotations = {
          "checksum/config" = local.prometheus_config_checksum
          "checksum/rules"  = local.prometheus_rules_checksum
        }
      }

      spec {
        service_account_name = kubernetes_service_account.prometheus.metadata[0].name
        container {
          name  = "prometheus"
          image = "prom/prometheus:${local.app_version}"
          args = [
            "--config.file=/etc/prometheus/prometheus.yml",
            "--storage.tsdb.path=/prometheus/",
            "--storage.tsdb.retention.time=${var.retention_time}",
          ]

          port {
            name           = "http-prometheus"
            container_port = 9090
          }

          security_context {
            run_as_user                = 1000
            run_as_group               = 1000
            run_as_non_root            = true
            allow_privilege_escalation = false
          }

          volume_mount {
            name       = "prometheus-config-volume"
            mount_path = "/etc/prometheus/"
          }
          volume_mount {
            name       = "prometheus-storage-volume"
            mount_path = "/prometheus"
          }
        }

        volume {
          name = "prometheus-config-volume"
          config_map {
            name = kubernetes_config_map.prometheus.metadata[0].name
          }
        }

        volume {
          name = "prometheus-storage-volume"
          host_path {
            path = local.data_folder
            type = "DirectoryOrCreate"
          }
        }
      }
    }
  }
}

resource "kubernetes_service" "prometheus" {
  metadata {
    name      = "prometheus"
    namespace = kubernetes_namespace.prometheus.metadata[0].name
    annotations = {
      "prometheus.io/scrape" = "true"
      "prometheus.io/port"   = "9090"
    }
  }

  spec {
    selector = {
      app = "prometheus"
    }

    type = "ClusterIP"

    port {
      port        = 9090
      protocol    = "TCP"
      target_port = "http-prometheus"
    }
  }
}

# resource "kubernetes_ingress_v1" "prometheus" {
#   metadata {
#     name      = "prometheus-ui"
#     namespace = kubernetes_namespace.prometheus.metadata[0].name
#     annotations = {
#       "kubernetes.io/ingress.class" = var.ingress_class
#     }
#   }

#   spec {
#     rule {
#       host = var.fqdn
#       http {
#         path {
#           path      = "/"
#           path_type = "Prefix"
#           backend {
#             service {
#               name = kubernetes_service.prometheus.metadata[0].name
#               port {
#                 number = 8080
#               }
#             }
#           }
#         }
#       }
#     }

#     dynamic "tls" {
#       for_each = local.tls_crt_data != "" && local.tls_key_data != "" ? [1] : []
#       content {
#         hosts       = [var.fqdn]
#         secret_name = local.tls_secret_name
#       }
#     }
#   }
# }