Ansible Role: exporter exporter

Description

Deploy prometheus Exporter Exporter using ansible.

Exporter exporter is a Prometheus exporter providing a reverse proxy for others Prometheus exporters, allowing to open only one port, it also provide TLS communication and Bearer Authentication.

It's a lightweight and simple alternative to NGINX/Apache reverse proxy, especially when the monitored server is not a web server...

More informations on Exporter Exporter Readme page

Notes

Role forked and largely inspired by Cloudalchemy Node Exporter Ansible role

Role is supposed to work with Debian, Suse, RedHat, Fedora, (See Ansible Galaxy meta), but it was only tested on Ubuntu Bionic (18.04).

TODO:

(Probably never done, PR accepted)

More control in preflight file
Support of config.dirs
Managment of Bearer token file
Unit test
Publish on Ansible Galaxy

Requirements

Ansible >= 2.7 (It might work on previous versions, but we cannot guarantee it)
gnu-tar on Mac deployer host (brew install gnu-tar)

Role Variables

All variables which can be overridden are stored in defaults/main.yml file as well as in table below.

Name	Default Value	Description
`exporter_exporter_version`	0.3.0	Used to install Exporter exporter package. Also accepts latest as parameter.
`exporter_exporter_system_group`	"exp-exp"	System group used to run exporter_exporter (used to launch exporter_exporter binary in systemd service unit file)
`exporter_exporter_system_user`	"exp-exp"	System user used to run exporter_exporter (used to launch exporter_exporter binary in systemd service unit file)
`exporter_exporter_system_additional_groups`	""	Additional system group of user used to run exporter_exporter (example: ssl-cert to allow reading certificate, used to launch exporter_exporter binary in systemd service unit file)
`exporter_exporter_web_listen_address`	"0.0.0.0:9999"	Address on which node exporter will listen (HTTP), leave empty and provide `exporter_exporter_web_tls_listen_address` for HTTPS connection only (used to launch exporter_exporter binary in systemd service unit file)
`exporter_exporter_config_file`	"/etc/expexp.yaml"	File containing exporter_exporter configuration, managed with this role throught `exporter_exporter_configuration` variable (used to launch exporter_exporter binary in systemd service unit file)
`exporter_exporter_web_bearer_token`	""	Token to provide to Bearer authentication (mutually exclusive with `exporter_exporter_web_bearer_token_file` variable, used to launch exporter_exporter binary in systemd service unit file)
`exporter_exporter_web_bearer_token_file`	""	File containing Bearer token for authentication (mutually exclusive with `exporter_exporter_web_bearer_token` variable, managment of the file not provided by this role, used to launch exporter_exporter binary in systemd service unit file)
`exporter_exporter_web_proxy_path`	""	URL to listen on for proxy HTTP requests. (default "/proxy" in exporter_exporter if not provided, used to launch exporter_exporter binary in systemd service unit file)
`exporter_exporter_web_telemetry_path`	""	URL to listen on for metrics of exporter_exporter itself. (default "/metrics" in exporter_exporter if not provided, used to launch exporter_exporter binary in systemd service unit file)
`exporter_exporter_web_tls_ca`	""	Full path of file containing CA certificate (ie: Prometheur server cert if self-signed certificate are used, used to launch exporter_exporter binary in systemd service unit file)
`exporter_exporter_web_tls_cert`	""	Full path of file containing certificate used by exporter_exporter (ie: Node certificate, used to launch exporter_exporter binary in systemd service unit file)
`exporter_exporter_web_tls_key`	""	Full path of file containing key used by exporter_exporter (ie: Node key, used to launch exporter_exporter binary in systemd service unit file)
`exporter_exporter_web_tls_listen_address`	""	Address on which node exporter will listen for TLS connections (HTTPS), optionnal, 0.0.0.0:9998 is usualy used (used to launch exporter_exporter binary in systemd service unit file)
`exporter_exporter_web_tls_verify`	""	Disable client verification (?, used to launch exporter_exporter binary in systemd service unit file)
`exporter_exporter_configuration`	""	YAML configuration set in `exporter_exporter_config_file` example provided in Exporter Exporter Readme

Exporter_exporter configuration can be breaked in multiple files in a directory provided to exporter_exporter throught config.dirs and config.skip-dirs, but this role does not support (yet) this.

This role can deploy node, server certificate and node key, following variables are use for this deployment :

Name	Default Value	Description
`exporter_exporter_ca_file`	""	Local path to the file containing CA certificate / server certificate (ie: files/prometheus_server.crt)
`exporter_exporter_cert_file`	""	Local path to the file containing node certificate (ie: files/prometheus_node.crt)
`exporter_exporter_key_file`	""	Local path to the file containing node key (ie: files/prometheus_server.key) Best practice is to encrypt this file with ansible-vault
`exporter_exporter_certs_path`	""	Distant path (on monitored nodes) where this role will copy the 2 certificates, must be the same in `exporter_exporter_web_tls_ca` and `exporter_exporter_web_tls_cert` variables (ie: /etc/ssl/certs/)
`exporter_exporter_cert_owner`	""	Certificates file owner (ie: root)
`exporter_exporter_cert_group`	""	Certificates file group (ie: exp-exp)
`exporter_exporter_cert_mode`	""	Certificate file mode (ie: 0640)
`exporter_exporter_key_path`	""	Distant path (on monitored nodes) where this role will copy the node key, must be the same in `exporter_exporter_web_tls_key` variable (ie: /etc/ssl/private/)
`exporter_exporter_key_owner`	""	Key file owner (ie: root)
`exporter_exporter_key_group`	""	Key file group (ie: exp-exp)
`exporter_exporter_key_mode`	""	Key file mode (ie: 0640)

Creation of those certificates and key is not part of this role.

Example

Playbook

Use it in a playbook as follows:

- hosts: all
  roles:
    - umanit.prometheus_exporter_exporter
  vars:
    exporter_exporter_configuration:
      modules:
        node:
          method: http
          http:
             port: 9100

License

This project is licensed under MIT License. See LICENSE for more details.

urusha / ansible-prometheus_exporter_exporter