kubernetes/apps/monitoring/helmrelease-blackbox-exporter.yaml

@@ -28,9 +28,14 @@ spec:
           # this ServiceMonitor (its selector matches release).
           release: kube-prometheus-stack
         interval: 30s
-    # Default modules cover http_2xx, http_post_2xx, tcp_connect,
-    # icmp, dns. Helm deep-merges maps, so adding module keys under
-    # config.modules keeps the chart's stock modules intact.
+    # Helm DOES deep-merge this map with the chart's default (that is why
+    # the chart's http_2xx is still in the rendered ConfigMap alongside
+    # the additions below) — but the chart's default ships exactly ONE
+    # module, http_2xx. http_post_2xx/tcp_connect/icmp/dns exist only in
+    # upstream blackbox_exporter's EXAMPLE config, which this chart does
+    # not use. So every module a Probe references must be declared right
+    # here; otherwise the exporter answers that /probe with 400 Bad
+    # Request and the target goes down with no probe_* metrics at all.
     config:
       modules:
         # WAN-path probe of the public edge by proxy IP. Probing the NAME
@@ -51,3 +56,17 @@ spec:
               server_name: home.renner.uno
             headers:
               Host: home.renner.uno
+        # Plain TCP connect, used by the blackbox-tcp-relays Probe for the
+        # NetBird relay ws listeners on :33080. Address family is spelled
+        # out as ip6-then-fallback (blackbox's own tcp default, pinned so
+        # an upstream default flip can't break it): the relay members are
+        # mixed — proxy-1.renner.uno is v6-only and
+        # proxy-2.renner.uno is dual-stack (observed live: probe_ip_protocol
+        # is 6 and 4 respectively on their :9000/health probes) — so
+        # pinning either family would break one member.
+        tcp_connect:
+          prober: tcp
+          timeout: 5s
+          tcp:
+            preferred_ip_protocol: ip6
+            ip_protocol_fallback: true