Add platform infrastructure configuration

2026-08-28 17:35:41 +09:00
parent fa76531e5b
commit 16c337bcc9
302 changed files with 83259 additions and 1 deletions
@@ -0,0 +1,22 @@
+# Blackbox exporter
+
+This component deploys the pinned Prometheus blackbox exporter as an internal
+`ClusterIP` service in the `observability` namespace. The `/probe` handler is
+reachable only from the Prometheus Pod; it has no Ingress, NodePort, host port,
+or service-account token.
+
+Only three fixed `Probe` groups are declared:
+
+- `platform-public-edge`: Gitea health and Keycloak discovery through Host Nginx
+- `platform-private-edge`: Grafana, pgAdmin, and AIStor Console must return 403
+- `platform-private-internal`: the same private services must return 200 through
+  their ClusterIP Services
+
+The internal Grafana and pgAdmin targets use the blackbox exporter's `hostname`
+parameter to set their required HTTP Host header. Target URLs and modules are
+declarative; arbitrary callers are not granted access to port 9115.
+
+The private-edge source boundary was proven separately and recorded as a
+root-only `platform-blackbox-source-v1` evidence file. Applying this component
+must remain gated on that evidence matching the active deny-only Nginx config.
+
@@ -0,0 +1,45 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: observability
+
+resources:
+  - probes-public.yaml
+  - probes-private-edge.yaml
+  - probes-private-internal.yaml
+  - network-policy.yaml
+
+helmGlobals:
+  chartHome: .helm/charts
+
+helmCharts:
+  - name: prometheus-blackbox-exporter
+    repo: https://prometheus-community.github.io/helm-charts
+    version: 11.16.0
+    releaseName: blackbox-exporter
+    namespace: observability
+    valuesFile: values/home.yaml
+    includeCRDs: false
+    skipTests: true
+
+patches:
+  - target:
+      version: v1
+      kind: ServiceAccount
+      name: blackbox-exporter
+    patch: |-
+      - op: add
+        path: /automountServiceAccountToken
+        value: false
+  - target:
+      group: apps
+      version: v1
+      kind: Deployment
+      name: blackbox-exporter
+    patch: |-
+      - op: add
+        path: /spec/template/spec/hostPID
+        value: false
+      - op: add
+        path: /spec/template/spec/hostIPC
+        value: false
@@ -0,0 +1,88 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: observability-allow-prometheus-to-blackbox
+  namespace: observability
+  labels:
+    app.kubernetes.io/name: prometheus-blackbox-exporter
+    app.kubernetes.io/part-of: platform-observability
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: prometheus-blackbox-exporter
+      app.kubernetes.io/instance: blackbox-exporter
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: prometheus
+              app.kubernetes.io/instance: observability-core-kube-pr-prometheus
+      ports:
+        - protocol: TCP
+          port: 9115
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: observability-allow-blackbox-egress
+  namespace: observability
+  labels:
+    app.kubernetes.io/name: prometheus-blackbox-exporter
+    app.kubernetes.io/part-of: platform-observability
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: prometheus-blackbox-exporter
+      app.kubernetes.io/instance: blackbox-exporter
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    - to:
+        - ipBlock:
+            cidr: 192.168.0.107/32
+      ports:
+        - protocol: TCP
+          port: 443
+    - to:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: grafana
+              app.kubernetes.io/instance: grafana
+      ports:
+        - protocol: TCP
+          port: 3000
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: platform-admin
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: pgadmin4
+              app.kubernetes.io/instance: pgadmin
+      ports:
+        - protocol: TCP
+          port: 5050
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: object-storage
+          podSelector:
+            matchLabels:
+              aistor.min.io/objectStore: minio-aistor
+      ports:
+        - protocol: TCP
+          port: 9090
@@ -0,0 +1,28 @@
+apiVersion: monitoring.coreos.com/v1
+kind: Probe
+metadata:
+  name: platform-private-edge
+  namespace: observability
+  labels:
+    app.kubernetes.io/name: prometheus-blackbox-exporter
+    app.kubernetes.io/instance: blackbox-exporter
+    app.kubernetes.io/part-of: platform-observability
+    observability.hyeonworks.com/instance: home
+spec:
+  jobName: blackbox-private-edge
+  interval: 30s
+  scrapeTimeout: 15s
+  module: http_private_edge_403
+  prober:
+    url: blackbox-exporter.observability.svc.cluster.local:9115
+    scheme: http
+    path: /probe
+    proxyFromEnvironment: false
+  targets:
+    staticConfig:
+      labels:
+        observability.hyeonworks.com/probe-group: private-edge
+      static:
+        - https://grafana.learn.hyeonworks.com/
+        - https://storage-admin.learn.hyeonworks.com/
+        - https://db-admin.learn.hyeonworks.com/
@@ -0,0 +1,44 @@
+apiVersion: monitoring.coreos.com/v1
+kind: Probe
+metadata:
+  name: platform-private-internal
+  namespace: observability
+  labels:
+    app.kubernetes.io/name: prometheus-blackbox-exporter
+    app.kubernetes.io/instance: blackbox-exporter
+    app.kubernetes.io/part-of: platform-observability
+    observability.hyeonworks.com/instance: home
+spec:
+  jobName: blackbox-private-internal
+  interval: 30s
+  scrapeTimeout: 15s
+  module: http_private_internal_200
+  prober:
+    url: blackbox-exporter.observability.svc.cluster.local:9115
+    scheme: http
+    path: /probe
+    proxyFromEnvironment: false
+  targets:
+    staticConfig:
+      labels:
+        observability.hyeonworks.com/probe-group: private-internal
+      static:
+        - http://grafana.observability.svc.cluster.local/api/health
+        - http://pgadmin.platform-admin.svc.cluster.local/misc/ping
+        - http://minio-aistor-console.object-storage.svc.cluster.local:9090/
+      relabelingConfigs:
+        - sourceLabels:
+            - __param_target
+          regex: http://grafana[.]observability[.]svc[.]cluster[.]local/api/health
+          targetLabel: __param_hostname
+          replacement: grafana.learn.hyeonworks.com
+        - sourceLabels:
+            - __param_target
+          regex: http://pgadmin[.]platform-admin[.]svc[.]cluster[.]local/misc/ping
+          targetLabel: __param_hostname
+          replacement: db-admin.learn.hyeonworks.com
+        - sourceLabels:
+            - __param_target
+          regex: http://minio-aistor-console[.]object-storage[.]svc[.]cluster[.]local:9090/
+          targetLabel: __param_hostname
+          replacement: storage-admin.learn.hyeonworks.com
@@ -0,0 +1,27 @@
+apiVersion: monitoring.coreos.com/v1
+kind: Probe
+metadata:
+  name: platform-public-edge
+  namespace: observability
+  labels:
+    app.kubernetes.io/name: prometheus-blackbox-exporter
+    app.kubernetes.io/instance: blackbox-exporter
+    app.kubernetes.io/part-of: platform-observability
+    observability.hyeonworks.com/instance: home
+spec:
+  jobName: blackbox-public-edge
+  interval: 30s
+  scrapeTimeout: 15s
+  module: http_2xx
+  prober:
+    url: blackbox-exporter.observability.svc.cluster.local:9115
+    scheme: http
+    path: /probe
+    proxyFromEnvironment: false
+  targets:
+    staticConfig:
+      labels:
+        observability.hyeonworks.com/probe-group: public-edge
+      static:
+        - https://git.learn.hyeonworks.com/api/healthz
+        - https://id.learn.hyeonworks.com/realms/hyeonworks/.well-known/openid-configuration
@@ -0,0 +1,128 @@
+fullnameOverride: blackbox-exporter
+
+commonLabels:
+  observability.hyeonworks.com/instance: home
+
+kind: Deployment
+replicas: 1
+revisionHistoryLimit: 3
+
+strategy:
+  type: Recreate
+  rollingUpdate: null
+
+automountServiceAccountToken: false
+hostNetwork: false
+hostPort: 0
+
+image:
+  registry: quay.io
+  repository: prometheus/blackbox-exporter
+  tag: v0.28.0
+  digest: sha256:43027b43fb785b7c5adc53bd3b5dbc1a258270a2e8aff24f477b45c4e38dac68
+  pullPolicy: IfNotPresent
+
+podSecurityContext:
+  runAsNonRoot: true
+  runAsUser: 1000
+  runAsGroup: 1000
+  seccompProfile:
+    type: RuntimeDefault
+
+securityContext:
+  runAsNonRoot: true
+  runAsUser: 1000
+  runAsGroup: 1000
+  readOnlyRootFilesystem: true
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+  seccompProfile:
+    type: RuntimeDefault
+
+resources:
+  requests:
+    cpu: 25m
+    memory: 32Mi
+  limits:
+    cpu: 200m
+    memory: 128Mi
+
+serviceAccount:
+  create: true
+  name: blackbox-exporter
+
+service:
+  type: ClusterIP
+  port: 9115
+
+ingress:
+  enabled: false
+
+route:
+  main:
+    enabled: false
+
+networkPolicy:
+  enabled: false
+
+configReloader:
+  enabled: false
+
+serviceMonitor:
+  enabled: false
+  selfMonitor:
+    enabled: true
+    port: http
+    interval: 30s
+    scrapeTimeout: 10s
+
+config:
+  modules:
+    http_2xx:
+      prober: http
+      timeout: 10s
+      http:
+        method: GET
+        valid_status_codes:
+          - 200
+        valid_http_versions:
+          - HTTP/1.1
+          - HTTP/2.0
+        follow_redirects: true
+        enable_http2: true
+        preferred_ip_protocol: ip4
+        ip_protocol_fallback: false
+        tls_config:
+          insecure_skip_verify: false
+    http_private_edge_403:
+      prober: http
+      timeout: 10s
+      http:
+        method: GET
+        valid_status_codes:
+          - 403
+        valid_http_versions:
+          - HTTP/1.1
+          - HTTP/2.0
+        follow_redirects: true
+        enable_http2: true
+        preferred_ip_protocol: ip4
+        ip_protocol_fallback: false
+        tls_config:
+          insecure_skip_verify: false
+    http_private_internal_200:
+      prober: http
+      timeout: 10s
+      http:
+        method: GET
+        valid_status_codes:
+          - 200
+        valid_http_versions:
+          - HTTP/1.1
+          - HTTP/2.0
+        follow_redirects: true
+        enable_http2: true
+        preferred_ip_protocol: ip4
+        ip_protocol_fallback: false