additional monitoring scrapes

cluster/applications/monitoring/pve-exporter.yaml

@@ -0,0 +1,117 @@
+# ------------------------------------------------------------------------------
+# Proxmox VE Exporter
+# Scrapes the Proxmox cluster API for VM states, storage, CPU metrics.
+# Uses multi-target pattern — Prometheus passes the target node as a param.
+#
+# Credentials: prometheus@pve!prometheus-token
+# Config file mounted from Secret (populated by ESO from 1Password)
+# ------------------------------------------------------------------------------
+
+# ConfigMap for pve.yml — credentials file for the exporter
+# Token value injected at runtime from the Secret via init container
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: pve-exporter-config
+  namespace: monitoring
+data:
+  pve.yml: |
+    default:
+      user: prometheus@pve
+      token_name: prometheus-token
+      verify_ssl: false
+---
+# Deployment
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pve-exporter
+  namespace: monitoring
+  labels:
+    app: pve-exporter
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: pve-exporter
+  template:
+    metadata:
+      labels:
+        app: pve-exporter
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      initContainers:
+        # Merge the token value from the secret into the config file
+        - name: config-init
+          image: busybox:1.36
+          command:
+            - sh
+            - -c
+            - |
+              cp /config-ro/pve.yml /config/pve.yml
+              echo "  token_value: $(cat /secrets/token-value)" >> /config/pve.yml
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - name: config-ro
+              mountPath: /config-ro
+            - name: config-rw
+              mountPath: /config
+            - name: secret
+              mountPath: /secrets
+      containers:
+        - name: pve-exporter
+          image: prompve/prometheus-pve-exporter:3.5.1
+          args:
+            - --config.file=/config/pve.yml
+          ports:
+            - containerPort: 9221
+              name: metrics
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - name: config-rw
+              mountPath: /config
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 200m
+              memory: 128Mi
+      volumes:
+        - name: config-ro
+          configMap:
+            name: pve-exporter-config
+        - name: config-rw
+          emptyDir: {}
+        - name: secret
+          secret:
+            secretName: pve-exporter-secret
+---
+# Service
+apiVersion: v1
+kind: Service
+metadata:
+  name: pve-exporter
+  namespace: monitoring
+  labels:
+    app: pve-exporter
+spec:
+  selector:
+    app: pve-exporter
+  ports:
+    - name: metrics
+      port: 9221
+      targetPort: 9221