additional monitoring scrapes

cluster/applications/monitoring/snmp-exporter.yaml

@@ -0,0 +1,152 @@
+# ------------------------------------------------------------------------------
+# SNMP Exporter
+# Scrapes UniFi network devices via SNMP v2c.
+# Uses multi-target pattern — Prometheus passes device IP as a param.
+#
+# Devices:
+#   - world-drive     (UDM Pro)        192.168.1.1
+#   - usw-pro-agg     (USW-Pro-Agg)    192.168.1.123
+#   - usw-pro-max-24  (USW-Pro-Max-24) 192.168.1.226
+#   - usw-lite-16-poe (USW-Lite-16)    192.168.1.136
+#   - ups-tower       (UPS-Tower)      192.168.1.233
+# ------------------------------------------------------------------------------
+
+# SNMP exporter config — if_mib module with community from secret
+# Uses an init container to inject the community string at runtime
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: snmp-exporter-config
+  namespace: monitoring
+data:
+  snmp.yml: |
+    auths:
+      mk_labs_v2c:
+        community: COMMUNITY_PLACEHOLDER
+        version: 2
+    modules:
+      if_mib:
+        walk:
+          - interfaces
+        auth: mk_labs_v2c
+        metrics:
+          - name: ifIndex
+            oid: 1.3.6.1.2.1.2.2.1.1
+            type: gauge
+            help: A unique value for each interface
+          - name: ifDescr
+            oid: 1.3.6.1.2.1.2.2.1.2
+            type: DisplayString
+            help: Interface description
+          - name: ifOperStatus
+            oid: 1.3.6.1.2.1.2.2.1.8
+            type: gauge
+            help: Interface operational status
+          - name: ifInOctets
+            oid: 1.3.6.1.2.1.2.2.1.10
+            type: counter
+            help: Bytes received
+          - name: ifOutOctets
+            oid: 1.3.6.1.2.1.2.2.1.16
+            type: counter
+            help: Bytes sent
+          - name: ifInErrors
+            oid: 1.3.6.1.2.1.2.2.1.14
+            type: counter
+            help: Inbound errors
+          - name: ifOutErrors
+            oid: 1.3.6.1.2.1.2.2.1.20
+            type: counter
+            help: Outbound errors
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: snmp-exporter
+  namespace: monitoring
+  labels:
+    app: snmp-exporter
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: snmp-exporter
+  template:
+    metadata:
+      labels:
+        app: snmp-exporter
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      initContainers:
+        - name: config-init
+          image: busybox:1.36
+          command:
+            - sh
+            - -c
+            - |
+              COMMUNITY=$(cat /secrets/community)
+              sed "s/COMMUNITY_PLACEHOLDER/$COMMUNITY/" /config-ro/snmp.yml > /config/snmp.yml
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - name: config-ro
+              mountPath: /config-ro
+            - name: config-rw
+              mountPath: /config
+            - name: secret
+              mountPath: /secrets
+      containers:
+        - name: snmp-exporter
+          image: prom/snmp-exporter:v0.26.0
+          args:
+            - --config.file=/config/snmp.yml
+          ports:
+            - containerPort: 9116
+              name: metrics
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - name: config-rw
+              mountPath: /config
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 200m
+              memory: 128Mi
+      volumes:
+        - name: config-ro
+          configMap:
+            name: snmp-exporter-config
+        - name: config-rw
+          emptyDir: {}
+        - name: secret
+          secret:
+            secretName: snmp-community-secret
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: snmp-exporter
+  namespace: monitoring
+  labels:
+    app: snmp-exporter
+spec:
+  selector:
+    app: snmp-exporter
+  ports:
+    - name: metrics
+      port: 9116
+      targetPort: 9116