feat(wireguard): add prometheus monitoring, alerts, and grafana dashboard

k8s/wireguard/deployment.yaml

@@ -7,6 +7,8 @@ metadata:
     app: wireguard
 spec:
   replicas: 1
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: wireguard
@@ -25,6 +27,7 @@ spec:
             apk add --no-cache wireguard-tools iptables
             cp /config/wg0.conf /etc/wireguard/wg0.conf
             chmod 600 /etc/wireguard/wg0.conf
+            wg-quick down wg0 || true
             wg-quick up wg0
             echo "Wireguard is up"
             trap "wg-quick down wg0" SIGINT SIGTERM
@@ -44,6 +47,25 @@ spec:
         - name: lib-modules
           mountPath: /lib/modules
           readOnly: true
+      - name: exporter
+        image: mindflavor/prometheus-wireguard-exporter:latest
+        args:
+          - "-n"
+          - "/config/wg0.conf"
+        ports:
+          - name: http-metrics
+            containerPort: 9586
+            protocol: TCP
+        securityContext:
+          runAsUser: 0
+          capabilities:
+            add:
+              - NET_ADMIN
+        volumeMounts:
+        - name: wg-config
+          mountPath: /config/wg0.conf
+          subPath: wg0.conf
+          readOnly: true
       volumes:
       - name: wg-config
         secret:

k8s/wireguard/kustomization.yaml

@@ -7,3 +7,4 @@ resources:
   - namespace.yaml
   - secret.secret.yaml
   - deployment.yaml
+  - monitoring.yaml

k8s/wireguard/monitoring.yaml

@@ -0,0 +1,71 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: wireguard-exporter
+  namespace: wireguard
+  labels:
+    app: wireguard
+spec:
+  ports:
+    - name: http-metrics
+      port: 9586
+      targetPort: 9586
+      protocol: TCP
+  selector:
+    app: wireguard
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: wireguard
+  namespace: wireguard
+  labels:
+    release: prometheus-operator
+spec:
+  selector:
+    matchLabels:
+      app: wireguard
+  namespaceSelector:
+    matchNames:
+      - wireguard
+  endpoints:
+    - port: http-metrics
+      path: /metrics
+      interval: 30s
+      scrapeTimeout: 10s
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: wireguard-alerts
+  namespace: wireguard
+  labels:
+    release: prometheus-operator
+spec:
+  groups:
+    - name: wireguard.rules
+      rules:
+        - alert: WireguardExporterDown
+          expr: up{job="wireguard-exporter"} == 0
+          for: 5m
+          labels:
+            severity: critical
+          annotations:
+            summary: "WireGuard exporter is down"
+            description: "The WireGuard Prometheus exporter is unreachable. The pod may have crashed or is unresponsive."
+        - alert: WireguardInterfaceDown
+          expr: absent(wireguard_sent_bytes_total{interface="wg0"}) == 1
+          for: 5m
+          labels:
+            severity: critical
+          annotations:
+            summary: "WireGuard interface wg0 is down"
+            description: "The WireGuard interface wg0 is not reporting any statistics. The VPN tunnel might be down or inactive."
+        - alert: WireguardPeerOffline
+          expr: (time() - wireguard_latest_handshake_seconds{interface="wg0"}) > 300
+          for: 5m
+          labels:
+            severity: critical
+          annotations:
+            summary: "WireGuard peer {{ $labels.friendly_name }} offline"
+            description: "No handshake received for WireGuard peer {{ $labels.friendly_name }} ({{ $labels.public_key }}) on device {{ $labels.interface }} for more than 5 minutes."