atlas-botandClaude Opus 5.5
21a7583523
Comments that pointed at other YAML as `file.yaml:N` went stale on any edit above the cited line; three drift fixes had been merged by hand (REN-181). The cited block now carries `# anchor: <name>` and the comment cites `path.yaml#<name>`. - Sweep: all 32 line-number citations in YAML comments converted. Several were already stale at head and now point at the right block (see PR). Vendored files (Flux gotk-components, IMC CRD) get no anchor; those two citations name the object/schema path instead. - Guard: scripts/ci/yaml-citations.sh in ci-manifests-test.yml; fails on a line-number citation or a path#name whose file/anchor is gone. Self-test in ci-scripts-test.yml. - CONTRIBUTING.md: the convention in three lines. Comment-only under kubernetes/: every file parses to identical objects before and after, so Flux applies nothing and no ConfigMap data changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
146 lines
5.6 KiB
YAML
146 lines
5.6 KiB
YAML
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: blackbox-exporter
|
|
# anchor: namespace
|
|
namespace: monitoring
|
|
spec:
|
|
interval: 30m
|
|
chart:
|
|
spec:
|
|
chart: prometheus-blackbox-exporter
|
|
version: ">=9.0.0"
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: prometheus-community
|
|
namespace: monitoring
|
|
install:
|
|
remediation:
|
|
retries: 3
|
|
upgrade:
|
|
remediation:
|
|
retries: 3
|
|
values:
|
|
serviceMonitor:
|
|
enabled: true
|
|
defaults:
|
|
labels:
|
|
# Not required for discovery — serviceMonitorSelector is empty — but
|
|
# kept for consistency with the other monitors. The Probes in
|
|
# monitoring-rules/probes-blackbox.yaml do need it; probeSelector
|
|
# still matches on release.
|
|
release: kube-prometheus-stack
|
|
interval: 30s
|
|
# Helm DOES deep-merge this map with the chart's default (that is why
|
|
# the chart's http_2xx is still in the rendered ConfigMap alongside
|
|
# the additions below) — but the chart's default ships exactly ONE
|
|
# module, http_2xx. http_post_2xx/tcp_connect/icmp/dns exist only in
|
|
# upstream blackbox_exporter's EXAMPLE config, which this chart does
|
|
# not use. So every module a Probe references must be declared right
|
|
# here; otherwise the exporter answers that /probe with 400 Bad
|
|
# Request and the target goes down with no probe_* metrics at all.
|
|
config:
|
|
modules:
|
|
# WAN-path probe of the public edge by proxy IP. Probing the NAME
|
|
# from in-cluster is useless twice over: CoreDNS/k8s_gateway
|
|
# resolves public names straight to the cluster VIP, and the LAN
|
|
# hairpin DNAT rewrites the proxy IPs on most VLANs — but NOT on
|
|
# the Server/Ingress VLANs the nodes sit on (deliberately absent
|
|
# from unifi_nat_hairpin.tf), so an IP-literal probe from this
|
|
# exporter genuinely leaves via the WAN and comes back through
|
|
# the netcup reverse-proxy edge. SNI + Host are pinned to the
|
|
# served domain because the target is an IP literal.
|
|
http_2xx_wan_edge:
|
|
prober: http
|
|
timeout: 10s
|
|
http:
|
|
fail_if_not_ssl: true
|
|
tls_config:
|
|
server_name: home.renner.uno
|
|
headers:
|
|
Host: home.renner.uno
|
|
# Plain TCP connect, used by the blackbox-tcp-relays Probe for the
|
|
# NetBird relay ws listeners on :33080. Address family is spelled
|
|
# out as ip6-then-fallback (blackbox's own tcp default, pinned so
|
|
# an upstream default flip can't break it): the relay members are
|
|
# mixed — proxy-1.renner.uno is v6-only and
|
|
# proxy-2.renner.uno is dual-stack (observed live: probe_ip_protocol
|
|
# is 6 and 4 respectively on their :9000/health probes) — so
|
|
# pinning either family would break one member.
|
|
tcp_connect:
|
|
prober: tcp
|
|
timeout: 5s
|
|
tcp:
|
|
preferred_ip_protocol: ip6
|
|
ip_protocol_fallback: true
|
|
# One module per name: the dns prober takes the RESOLVER as its
|
|
# target and reads query_name from the module, so a name cannot be
|
|
# passed per scrape. The Probes in monitoring-rules/probes-dns.yaml
|
|
# point these at the UDM.
|
|
#
|
|
# Both answer checks are load-bearing. valid_rcodes alone passes a
|
|
# deleted record two labels deep (NOERROR, no answer), and the public
|
|
# *.renner.uno wildcard answers one label deep with a CNAME to
|
|
# proxy.renner.uno — NOERROR with the WAN proxy behind it. Requiring
|
|
# an A and rejecting a CNAME separates a real record from both.
|
|
dns_lan_ha:
|
|
prober: dns
|
|
timeout: 5s
|
|
dns:
|
|
query_name: ha.renner.uno
|
|
query_type: A
|
|
valid_rcodes: [NOERROR]
|
|
validate_answer_rrs:
|
|
fail_if_not_matches_regexp: ['\sIN\s+A\s']
|
|
fail_if_matches_regexp: ['\sIN\s+CNAME\s']
|
|
dns_lan_mqtt:
|
|
prober: dns
|
|
timeout: 5s
|
|
dns:
|
|
query_name: mqtt.renner.uno
|
|
query_type: A
|
|
valid_rcodes: [NOERROR]
|
|
validate_answer_rrs:
|
|
fail_if_not_matches_regexp: ['\sIN\s+A\s']
|
|
fail_if_matches_regexp: ['\sIN\s+CNAME\s']
|
|
dns_lan_ldap:
|
|
prober: dns
|
|
timeout: 5s
|
|
dns:
|
|
query_name: ldap.renner.uno
|
|
query_type: A
|
|
valid_rcodes: [NOERROR]
|
|
validate_answer_rrs:
|
|
fail_if_not_matches_regexp: ['\sIN\s+A\s']
|
|
fail_if_matches_regexp: ['\sIN\s+CNAME\s']
|
|
dns_lan_syslog:
|
|
prober: dns
|
|
timeout: 5s
|
|
dns:
|
|
query_name: syslog.renner.uno
|
|
query_type: A
|
|
valid_rcodes: [NOERROR]
|
|
validate_answer_rrs:
|
|
fail_if_not_matches_regexp: ['\sIN\s+A\s']
|
|
fail_if_matches_regexp: ['\sIN\s+CNAME\s']
|
|
dns_lan_ftp_scanner:
|
|
prober: dns
|
|
timeout: 5s
|
|
dns:
|
|
query_name: ftp.paperless.renner.uno
|
|
query_type: A
|
|
valid_rcodes: [NOERROR]
|
|
validate_answer_rrs:
|
|
fail_if_not_matches_regexp: ['\sIN\s+A\s']
|
|
fail_if_matches_regexp: ['\sIN\s+CNAME\s']
|
|
dns_lan_syncthing:
|
|
prober: dns
|
|
timeout: 5s
|
|
dns:
|
|
query_name: syncthing.paperless.renner.uno
|
|
query_type: A
|
|
valid_rcodes: [NOERROR]
|
|
validate_answer_rrs:
|
|
fail_if_not_matches_regexp: ['\sIN\s+A\s']
|
|
fail_if_matches_regexp: ['\sIN\s+CNAME\s']
|