Initial commit

infrastructure/unpoller/manifests/deployment.yaml

@@ -0,0 +1,130 @@
+---
+# Unpoller Deployment
+# Collects metrics from Unifi Controller and exports to Prometheus
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: unpoller
+  namespace: unpoller
+  labels:
+    app: unpoller
+    app.kubernetes.io/name: unpoller
+    app.kubernetes.io/instance: unpoller
+    app.kubernetes.io/component: monitoring
+  annotations:
+    secret.reloader.stakater.com/reload: "unpoller-secret"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: unpoller
+      app.kubernetes.io/name: unpoller
+  template:
+    metadata:
+      labels:
+        app: unpoller
+        app.kubernetes.io/name: unpoller
+      annotations:
+        secret.reloader.stakater.com/reload: "unpoller-secret"
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - name: unpoller
+        image: ghcr.io/unpoller/unpoller:v2.11.2
+        securityContext:
+          runAsUser: 10000
+          runAsGroup: 10000
+          runAsNonRoot: true
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+              - ALL
+        imagePullPolicy: IfNotPresent
+        ports:
+        - name: http
+          containerPort: 9130
+          protocol: TCP
+        env:
+        - name: UP_UNIFI_DEFAULT_URL
+          value: "https://172.28.110.1"
+        - name: UP_UNIFI_DEFAULT_USER
+          valueFrom:
+            secretKeyRef:
+              name: unpoller-secret
+              key: unifi-user
+        - name: UP_UNIFI_DEFAULT_PASS
+          valueFrom:
+            secretKeyRef:
+              name: unpoller-secret
+              key: unifi-pass
+        - name: UP_UNIFI_DEFAULT_VERIFY_SSL
+          value: "false"
+        - name: UP_UNIFI_DEFAULT_SAVE_SITES
+          value: "true"
+        - name: UP_UNIFI_DEFAULT_SAVE_DPI
+          value: "true"
+        - name: UP_PROMETHEUS_HTTP_LISTEN
+          value: "0.0.0.0:9130"
+        - name: UP_PROMETHEUS_NAMESPACE
+          value: "unpoller"
+        - name: UP_INFLUXDB_DISABLE
+          value: "true"
+        resources:
+          requests:
+            cpu: 10m
+            memory: 128Mi
+          limits:
+            cpu: 100m
+            memory: 256Mi
+        livenessProbe:
+          httpGet:
+            path: /metrics
+            port: http
+          initialDelaySeconds: 30
+          periodSeconds: 30
+        readinessProbe:
+          httpGet:
+            path: /metrics
+            port: http
+          initialDelaySeconds: 10
+          periodSeconds: 10
+---
+# Unpoller Service
+apiVersion: v1
+kind: Service
+metadata:
+  name: unpoller
+  namespace: unpoller
+  labels:
+    app: unpoller
+    app.kubernetes.io/name: unpoller
+spec:
+  type: ClusterIP
+  ports:
+  - port: 9130
+    targetPort: http
+    protocol: TCP
+    name: http
+  selector:
+    app: unpoller
+    app.kubernetes.io/name: unpoller
+---
+# ServiceMonitor for Prometheus auto-discovery
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: unpoller
+  namespace: unpoller
+  labels:
+    app: unpoller
+    app.kubernetes.io/name: unpoller
+    release: kube-prometheus-stack
+spec:
+  selector:
+    matchLabels:
+      app: unpoller
+  endpoints:
+  - port: http
+    interval: 30s
+    path: /metrics

infrastructure/unpoller/manifests/unpoller-secret.yaml

@@ -0,0 +1,45 @@
+---
+# ExternalSecret for Unpoller Unifi credentials
+# Syncs credentials from Vault to Kubernetes Secret
+#
+# BOOTSTRAP SETUP:
+# ================
+# After first deployment, store your Unifi credentials in Vault:
+#
+#   kubectl exec -n vault vault-0 -- vault kv put secret/unpoller \
+#     unifi-user="your-unifi-username" \
+#     unifi-pass="your-unifi-password"
+#
+# Or use the API key approach (recommended):
+#   kubectl exec -n vault vault-0 -- vault kv put secret/unpoller \
+#     unifi-user="your-api-key" \
+#     unifi-pass="your-api-key"
+#
+# The ExternalSecret will automatically sync these to a Kubernetes secret
+# and Reloader will restart Unpoller when they change.
+#
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: unpoller-secret
+  namespace: unpoller
+  annotations:
+    meta.helm.sh/release-name: unpoller
+    meta.helm.sh/release-namespace: unpoller
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: unpoller-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: unifi-user
+      remoteRef:
+        key: secret/unpoller
+        property: unifi-user
+    - secretKey: unifi-pass
+      remoteRef:
+        key: secret/unpoller
+        property: unifi-pass