# ------------------------------------------------------------------------------
# SNMP Exporter
# Scrapes UniFi network devices via SNMP v2c.
# Uses multi-target pattern — Prometheus passes device IP as a param.
#
# Devices:
#   - world-drive     (UDM Pro)        192.168.1.1
#   - usw-pro-agg     (USW-Pro-Agg)    192.168.1.123
#   - usw-pro-max-24  (USW-Pro-Max-24) 192.168.1.226
#   - usw-lite-16-poe (USW-Lite-16)    192.168.1.136
#   - ups-tower       (UPS-Tower)      192.168.1.233
# ------------------------------------------------------------------------------

# SNMP exporter config — if_mib module with community from secret
# Uses an init container to inject the community string at runtime
apiVersion: v1
kind: ConfigMap
metadata:
  name: snmp-exporter-config
  namespace: monitoring
data:
  snmp.yml: |
    auths:
      mk_labs_v2c:
        community: COMMUNITY_PLACEHOLDER
        version: 2
    modules:
      if_mib:
        walk:
          - interfaces
        auth: mk_labs_v2c
        metrics:
          - name: ifIndex
            oid: 1.3.6.1.2.1.2.2.1.1
            type: gauge
            help: A unique value for each interface
          - name: ifDescr
            oid: 1.3.6.1.2.1.2.2.1.2
            type: DisplayString
            help: Interface description
          - name: ifOperStatus
            oid: 1.3.6.1.2.1.2.2.1.8
            type: gauge
            help: Interface operational status
          - name: ifInOctets
            oid: 1.3.6.1.2.1.2.2.1.10
            type: counter
            help: Bytes received
          - name: ifOutOctets
            oid: 1.3.6.1.2.1.2.2.1.16
            type: counter
            help: Bytes sent
          - name: ifInErrors
            oid: 1.3.6.1.2.1.2.2.1.14
            type: counter
            help: Inbound errors
          - name: ifOutErrors
            oid: 1.3.6.1.2.1.2.2.1.20
            type: counter
            help: Outbound errors
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: snmp-exporter
  namespace: monitoring
  labels:
    app: snmp-exporter
spec:
  replicas: 1
  selector:
    matchLabels:
      app: snmp-exporter
  template:
    metadata:
      labels:
        app: snmp-exporter
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      initContainers:
        - name: config-init
          image: busybox:1.36
          command:
            - sh
            - -c
            - |
              COMMUNITY=$(cat /secrets/community)
              sed "s/COMMUNITY_PLACEHOLDER/$COMMUNITY/" /config-ro/snmp.yml > /config/snmp.yml
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
          volumeMounts:
            - name: config-ro
              mountPath: /config-ro
            - name: config-rw
              mountPath: /config
            - name: secret
              mountPath: /secrets
      containers:
        - name: snmp-exporter
          image: prom/snmp-exporter:v0.26.0
          args:
            - --config.file=/config/snmp.yml
          ports:
            - containerPort: 9116
              name: metrics
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
          volumeMounts:
            - name: config-rw
              mountPath: /config
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 200m
              memory: 128Mi
      volumes:
        - name: config-ro
          configMap:
            name: snmp-exporter-config
        - name: config-rw
          emptyDir: {}
        - name: secret
          secret:
            secretName: snmp-community-secret
---
apiVersion: v1
kind: Service
metadata:
  name: snmp-exporter
  namespace: monitoring
  labels:
    app: snmp-exporter
spec:
  selector:
    app: snmp-exporter
  ports:
    - name: metrics
      port: 9116
      targetPort: 9116