Single PBS exporter with target config

Co-authored-by: 33Fraise33 <33Fraise33@users.noreply.github.com>

Author: opencode-agent[bot]

playbooks/host_files/beokpdcovm01/files/prometheus/alerts.d/pbs.rules.yml

@@ -2,7 +2,7 @@
 groups:
   - name: pbs.rules
     rules:
-      - alert: PBSBackupFailed
+      - alert: PBS - Backup Failed
         expr: pbs_task_status{task_type="backup",status=~"(?i:failed|error)"} == 1
         for: 10m
         labels:
@@ -11,7 +11,7 @@ groups:
           summary: "PBS backup failed on {{ $labels.node_name }}"
           description: "Backup {{ $labels.task }} for datastore {{ $labels.datastore }} failed."
 
-      - alert: PBSVerificationFailed
+      - alert: PBS - Verification Failed
         expr: pbs_task_status{task_type="verify",status=~"(?i:failed|error)"} == 1
         for: 10m
         labels:
@@ -20,7 +20,7 @@ groups:
           summary: "PBS verification failed on {{ $labels.node_name }}"
           description: "Verification {{ $labels.task }} for datastore {{ $labels.datastore }} failed."
 
-      - alert: PBSSyncFailed
+      - alert: PBS - Sync Failed
         expr: pbs_task_status{task_type="sync",status=~"(?i:failed|error)"} == 1
         for: 10m
         labels:

playbooks/host_files/beokpdcovm01/templates/prometheus/prometheus.yml.j2

@@ -263,19 +263,15 @@ scrape_configs:
           - "prometheus-adguard_exporter:9618"
 
 {% if prometheus.features.pbs_exporter | default(false) %}
-{% for pbs_instance in pbs_exporter_instances | default([]) %}
-  - job_name: 'pbs_exporter_{{ pbs_instance.name }}'
+  - job_name: 'pbs_exporter'
     metrics_path: /probe
     http_sd_configs:
       - <<: *netbox_auth
         url: https://netbox.unitix.be/api/plugins/prometheus-sd/virtual-machines/?status=active&tag=pbs
     relabel_configs:
       - source_labels: [__meta_netbox_name]
-        regex: '^{{ pbs_instance.netbox_name | regex_escape }}$'
-        action: keep
-      - source_labels: [__meta_netbox_primary_ip]
         target_label: __param_target
-      - source_labels: [__param_target]
+      - source_labels: [__meta_netbox_primary_ip]
         target_label: instance
       - source_labels: [__meta_netbox_name]
         target_label: node_name
@@ -286,9 +282,8 @@ scrape_configs:
       - source_labels: [__meta_netbox_role_slug]
         target_label: device_role
       - target_label: __address__
-        replacement: "prometheus-pbs-exporter-{{ pbs_instance.name }}:9569"
+        replacement: "prometheus-pbs_exporter:9569"
 
-{% endfor %}
 {% endif %}
 
   - job_name: "hass"

playbooks/host_vars/beokpdcovm01.yml

@@ -7,6 +7,15 @@ prometheus:
   features:
     pbs_exporter: true
 
+# Each target is keyed by the PBS VM's NetBox name. The target must be the
+# endpoint accepted by the PBS exporter; token secrets belong in Vault.
+# pbs_exporter_targets:
+#   - netbox_name: pbs.example
+#     target: https://pbs.example:8007
+#     api_token_id: prometheus@pbs!exporter
+#     api_token_secret: !vault |
+#       $ANSIBLE_VAULT;1.1;AES256
+
 cloudflared:
   docker_network: services
   service_token: !vault |

roles/prometheus/tasks/pbs_exporter.yml

@@ -1,75 +1,91 @@
 ---
-- name: Validate PBS exporter instances list
+- name: Validate PBS exporter targets list
   ansible.builtin.assert:
     that:
-      - pbs_exporter_instances is defined
-      - pbs_exporter_instances is sequence
-      - pbs_exporter_instances is not string
-      - pbs_exporter_instances | length > 0
-    fail_msg: >-
-      pbs_exporter_instances must be a non-empty inventory list.
+      - pbs_exporter_targets is defined
+      - pbs_exporter_targets is sequence
+      - pbs_exporter_targets is not string
+      - pbs_exporter_targets | length > 0
+    fail_msg: pbs_exporter_targets must be a non-empty inventory list.
   no_log: true
 
-- name: Validate PBS exporter instances
+- name: Validate PBS exporter targets
   ansible.builtin.assert:
     that:
-      - item.name is defined
-      - item.name is string
-      - item.name is match('^[a-z0-9][a-z0-9-]*$')
       - item.netbox_name is defined
       - item.netbox_name is string
       - item.netbox_name | length > 0
+      - item.target is defined
+      - item.target is string
+      - item.target | length > 0
       - item.api_token_id is defined
       - item.api_token_id is string
       - item.api_token_id | length > 0
       - item.api_token_secret is defined
       - item.api_token_secret is string
       - item.api_token_secret | length > 0
     fail_msg: >-
-      Every PBS exporter instance must define a lowercase name, netbox_name,
-      api_token_id, and api_token_secret.
-  loop: "{{ pbs_exporter_instances }}"
+      Every PBS exporter target must define netbox_name, target, api_token_id,
+      and api_token_secret.
+  loop: "{{ pbs_exporter_targets }}"
   loop_control:
     label: hidden
   no_log: true
 
-- name: Validate unique PBS exporter instance selectors
+- name: Validate unique PBS exporter target selectors
   ansible.builtin.assert:
     that:
       - >-
-        pbs_exporter_instances | map(attribute='name') | unique | list | length
-        == pbs_exporter_instances | length
+        pbs_exporter_targets | map(attribute='netbox_name') | unique | list | length
+        == pbs_exporter_targets | length
       - >-
-        pbs_exporter_instances | map(attribute='netbox_name') | unique | list | length
-        == pbs_exporter_instances | length
-    fail_msg: PBS exporter instance names and NetBox names must be unique.
+        pbs_exporter_targets | map(attribute='target') | unique | list | length
+        == pbs_exporter_targets | length
+    fail_msg: PBS exporter NetBox names and targets must be unique.
+  no_log: true
+
+- name: Create PBS exporter config directory
+  ansible.builtin.file:
+    path: "{{ docker.dir.config }}/prometheus_pbs_exporter"
+    state: directory
+    owner: root
+    group: root
+    mode: "0700"
   no_log: true
 
-- name: Remove legacy Prometheus PBS exporter
+- name: Render PBS exporter targets
+  ansible.builtin.template:
+    src: pbs_targets.yml.j2
+    dest: "{{ docker.dir.config }}/prometheus_pbs_exporter/targets.yml"
+    owner: root
+    group: root
+    mode: "0600"
+  no_log: true
+
+- name: Remove legacy per-target PBS exporters
   community.docker.docker_container:
-    name: prometheus-pbs_exporter
+    name: "prometheus-pbs-exporter-{{ item.name }}"
     state: absent
+  loop: "{{ pbs_exporter_instances | default([]) }}"
+  loop_control:
+    label: hidden
   no_log: true
 
-- name: Setup Prometheus PBS exporters
+- name: Setup Prometheus PBS exporter
   community.docker.docker_container:
-    name: "prometheus-pbs-exporter-{{ item.name }}"
+    name: prometheus-pbs_exporter
     image: "{{ pbs_exporter_image | default('natrontech/pbs-exporter:latest') }}"
     networks:
       - name: monitoring
     dns_servers: "{{ dns.servers }}"
-    env:
-      PBS_TOKEN_ID: "{{ item.api_token_id }}"
-      PBS_TOKEN_SECRET: "{{ item.api_token_secret }}"
-      PBS_TLS_INSECURE: "true"
+    volumes:
+      - "{{ docker.dir.config }}/prometheus_pbs_exporter/targets.yml:/config/targets.yml:ro"
+    command: "--config.file=/config/targets.yml"
     restart: true
     restart_policy: always
     state: started
     pull: true
     labels:
       traefik.enable: "false"
       com.unitix.prometheus.pbs-exporter: "true"
-  loop: "{{ pbs_exporter_instances }}"
-  loop_control:
-    label: hidden
   no_log: true

roles/prometheus/templates/pbs_targets.yml.j2

@@ -0,0 +1,9 @@
+---
+targets:
+{% for pbs_target in pbs_exporter_targets %}
+  - name: "{{ pbs_target.netbox_name }}"
+    target: "{{ pbs_target.target }}"
+    token_id: "{{ pbs_target.api_token_id }}"
+    token_secret: "{{ pbs_target.api_token_secret }}"
+    tls_insecure: true
+{% endfor %}