132 lines
3.8 KiB
YAML
132 lines
3.8 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: fritzbox-exporter
|
|
namespace: monitoring
|
|
labels:
|
|
app: fritzbox-exporter
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: fritzbox-exporter
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: fritzbox-exporter
|
|
spec:
|
|
initContainers:
|
|
# This initContainer implements the Egress Reject Workaround (Option B).
|
|
# The FRITZ!Box TR-064 API redirects login_sid.lua calls to its public WAN IP because
|
|
# we query it from a different subnet (192.168.11.1). When the WAN IP is dynamic or port
|
|
# 80/443 are closed, the HTTP client hangs for the default 2-minute Linux TCP timeout,
|
|
# failing the entire Prometheus scrape.
|
|
# This container injects iptables rules into the pod's network namespace to instantly
|
|
# reject (TCP RST) egress to any public WAN IPs on port 80/443. The exporter will immediately
|
|
# fail the login step (in ms) and continue scraping TR-064 metrics on port 49000 (which is allowed).
|
|
- name: init-iptables
|
|
image: alpine:latest
|
|
securityContext:
|
|
capabilities:
|
|
add:
|
|
- NET_ADMIN
|
|
command: ["/bin/sh", "-c"]
|
|
args:
|
|
- |
|
|
apk add --no-cache iptables
|
|
# Allow all local RFC1918 subnets and loopback
|
|
iptables -A OUTPUT -d 127.0.0.1/32 -j ACCEPT
|
|
iptables -A OUTPUT -d 10.0.0.0/8 -j ACCEPT
|
|
iptables -A OUTPUT -d 172.16.0.0/12 -j ACCEPT
|
|
iptables -A OUTPUT -d 192.168.0.0/16 -j ACCEPT
|
|
# Reject port 80 and 443 egress to any public IP (non-RFC1918)
|
|
iptables -A OUTPUT -p tcp --dport 80 -j REJECT --reject-with tcp-reset
|
|
iptables -A OUTPUT -p tcp --dport 443 -j REJECT --reject-with tcp-reset
|
|
echo "Egress iptables REJECT rules injected successfully"
|
|
containers:
|
|
- name: fritzbox-exporter
|
|
image: ghcr.io/sberk42/fritzbox_exporter/fritzbox_exporter:latest
|
|
imagePullPolicy: IfNotPresent
|
|
env:
|
|
- name: USERNAME
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: fritzbox-exporter-secret
|
|
key: username
|
|
- name: PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: fritzbox-exporter-secret
|
|
key: password
|
|
- name: GATEWAY_URL
|
|
value: "http://192.168.10.1:49000"
|
|
- name: LISTEN_ADDRESS
|
|
value: "0.0.0.0:9042"
|
|
ports:
|
|
- name: http-metrics
|
|
containerPort: 9042
|
|
resources:
|
|
requests:
|
|
cpu: 10m
|
|
memory: 32Mi
|
|
limits:
|
|
cpu: 100m
|
|
memory: 64Mi
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: fritzbox-exporter
|
|
namespace: monitoring
|
|
labels:
|
|
app: fritzbox-exporter
|
|
spec:
|
|
ports:
|
|
- name: http-metrics
|
|
port: 9042
|
|
targetPort: 9042
|
|
protocol: TCP
|
|
selector:
|
|
app: fritzbox-exporter
|
|
---
|
|
apiVersion: monitoring.coreos.com/v1
|
|
kind: ServiceMonitor
|
|
metadata:
|
|
name: fritzbox-exporter
|
|
namespace: monitoring
|
|
labels:
|
|
app: fritzbox-exporter
|
|
release: prometheus-operator
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app: fritzbox-exporter
|
|
namespaceSelector:
|
|
matchNames:
|
|
- monitoring
|
|
endpoints:
|
|
- port: http-metrics
|
|
path: /metrics
|
|
interval: 60s
|
|
scrapeTimeout: 15s
|
|
---
|
|
apiVersion: monitoring.coreos.com/v1
|
|
kind: PrometheusRule
|
|
metadata:
|
|
name: fritzbox-exporter-alerts
|
|
namespace: monitoring
|
|
labels:
|
|
release: prometheus-operator
|
|
spec:
|
|
groups:
|
|
- name: fritzbox-exporter.rules
|
|
rules:
|
|
- alert: FritzBoxExporterOffline
|
|
expr: up{job="fritzbox-exporter"} == 0
|
|
for: 1h
|
|
labels:
|
|
severity: warning
|
|
annotations:
|
|
summary: "FritzBox exporter is offline"
|
|
description: "The FritzBox exporter pod in the cluster cannot reach the router at 192.168.10.1 or the exporter itself is down."
|