Daniel Allaire
e648009b87
node_exporter sert en HTTPS via le cert step-ca (--web.config.file + cert-sync owned prometheus, motif .path). Prometheus scrape en scheme https + tls_config (ca=root_ca), vérifie contre l'IP en SAN. Vars : client_metrique_tls_actif, serveur_prometheus_metriques_tls. Prouvé : node_exporter HTTPS 200 (vérif root_ca), HTTP rejeté (400), 4 cibles Prometheus UP en https sans erreur. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
105 lines
3.1 KiB
YAML
105 lines
3.1 KiB
YAML
---
|
|
- name: Installer node_exporter
|
|
ansible.builtin.apt:
|
|
name: "{{ client_metrique_paquets }}"
|
|
state: present
|
|
update_cache: true
|
|
cache_valid_time: 3600
|
|
|
|
# --- TLS : synchroniser le cert step_ca AVANT d'activer --web.config.file ---
|
|
- name: TLS — repertoire des certificats (prometheus)
|
|
ansible.builtin.file:
|
|
path: "{{ client_metrique_tls_dir }}"
|
|
state: directory
|
|
owner: prometheus
|
|
group: prometheus
|
|
mode: "0700"
|
|
when: client_metrique_tls_actif | bool
|
|
|
|
- name: TLS — script de synchronisation du certificat
|
|
ansible.builtin.template:
|
|
src: setops-node-exporter-cert-sync.sh.j2
|
|
dest: /usr/local/sbin/setops-node-exporter-cert-sync
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
when: client_metrique_tls_actif | bool
|
|
|
|
- name: TLS — unites de synchronisation (service + path)
|
|
ansible.builtin.template:
|
|
src: "{{ item.s }}"
|
|
dest: "{{ item.d }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
loop:
|
|
- { s: "setops-node-exporter-cert-sync.service.j2", d: "/etc/systemd/system/setops-node-exporter-cert-sync.service" }
|
|
- { s: "setops-node-exporter-cert-sync.path.j2", d: "/etc/systemd/system/setops-node-exporter-cert-sync.path" }
|
|
loop_control:
|
|
label: "{{ item.d | basename }}"
|
|
when: client_metrique_tls_actif | bool
|
|
|
|
- name: TLS — activer la surveillance du certificat (path)
|
|
ansible.builtin.systemd:
|
|
name: setops-node-exporter-cert-sync.path
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|
|
when:
|
|
- client_metrique_tls_actif | bool
|
|
- not ansible_check_mode
|
|
|
|
- name: TLS — synchroniser le certificat maintenant
|
|
ansible.builtin.command: /usr/local/sbin/setops-node-exporter-cert-sync
|
|
changed_when: false
|
|
when:
|
|
- client_metrique_tls_actif | bool
|
|
- not ansible_check_mode
|
|
|
|
- name: TLS — deployer la web-config de node_exporter
|
|
ansible.builtin.template:
|
|
src: web-config.yml.j2
|
|
dest: "{{ client_metrique_web_config }}"
|
|
owner: root
|
|
group: prometheus
|
|
mode: "0640"
|
|
when: client_metrique_tls_actif | bool
|
|
notify: Redemarrer node_exporter
|
|
|
|
- name: TLS — verifier la presence du certificat synchronise
|
|
ansible.builtin.stat:
|
|
path: "{{ client_metrique_tls_dir }}/{{ item }}"
|
|
register: client_metrique_tls_stat
|
|
loop:
|
|
- node.crt
|
|
- node.key
|
|
when:
|
|
- client_metrique_tls_actif | bool
|
|
- not ansible_check_mode
|
|
|
|
- name: TLS — garde-fou, ne pas activer sans certificat en place
|
|
ansible.builtin.assert:
|
|
that:
|
|
- item.stat.exists
|
|
fail_msg: "Cert node_exporter absent ({{ item.item }}) — TLS non active."
|
|
loop: "{{ client_metrique_tls_stat.results | default([]) }}"
|
|
loop_control:
|
|
label: "{{ item.item }}"
|
|
when:
|
|
- client_metrique_tls_actif | bool
|
|
- not ansible_check_mode
|
|
|
|
- name: Definir les arguments de node_exporter (adresse d'ecoute)
|
|
ansible.builtin.template:
|
|
src: default-node-exporter.j2
|
|
dest: /etc/default/prometheus-node-exporter
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Redemarrer node_exporter
|
|
|
|
- name: Activer et demarrer node_exporter
|
|
ansible.builtin.systemd:
|
|
name: "{{ client_metrique_service }}"
|
|
enabled: true
|
|
state: started
|