From dce2de214599c7e3c7d725e0c69e80db993a8fc9 Mon Sep 17 00:00:00 2001 From: Alexander Gorelyshev Date: Wed, 17 Dec 2025 12:26:46 +0400 Subject: [PATCH 1/5] Add the `node_exporter` role --- roles/node_exporter/README.md | 34 +++++++++++++++++ roles/node_exporter/defaults/main.yml | 2 + roles/node_exporter/handlers/main.yml | 1 + roles/node_exporter/meta/main.yml | 17 +++++++++ .../molecule/default/converge.yml | 6 +++ .../molecule/default/molecule.yml | 27 ++++++++++++++ .../node_exporter/molecule/default/verify.yml | 15 ++++++++ roles/node_exporter/tasks/install.yml | 37 +++++++++++++++++++ roles/node_exporter/tasks/main.yml | 6 +++ roles/node_exporter/tasks/run.yml | 8 ++++ .../templates/node_exporter.service.j2 | 12 ++++++ roles/node_exporter/vars/main.yml | 1 + 12 files changed, 166 insertions(+) create mode 100644 roles/node_exporter/README.md create mode 100644 roles/node_exporter/defaults/main.yml create mode 100644 roles/node_exporter/handlers/main.yml create mode 100644 roles/node_exporter/meta/main.yml create mode 100644 roles/node_exporter/molecule/default/converge.yml create mode 100644 roles/node_exporter/molecule/default/molecule.yml create mode 100644 roles/node_exporter/molecule/default/verify.yml create mode 100644 roles/node_exporter/tasks/install.yml create mode 100644 roles/node_exporter/tasks/main.yml create mode 100644 roles/node_exporter/tasks/run.yml create mode 100644 roles/node_exporter/templates/node_exporter.service.j2 create mode 100644 roles/node_exporter/vars/main.yml diff --git a/roles/node_exporter/README.md b/roles/node_exporter/README.md new file mode 100644 index 0000000..0ff7a86 --- /dev/null +++ b/roles/node_exporter/README.md @@ -0,0 +1,34 @@ +Role Name +========= + +Deploy `prometheus/node_exporter` binary as a systemd unit. + +Requirements +------------ + +None + +Role Variables +-------------- + +`node_exporter_bin_path`: where to install the binary (default: `/usr/bin`). + +Dependencies +------------ + +None + +Example Playbook +---------------- + +See: [converge.yml](molecule/default/converge.yml) + +License +------- + +BSD + +Author Information +------------------ + +corvus-migratorius@proton.me diff --git a/roles/node_exporter/defaults/main.yml b/roles/node_exporter/defaults/main.yml new file mode 100644 index 0000000..daf4778 --- /dev/null +++ b/roles/node_exporter/defaults/main.yml @@ -0,0 +1,2 @@ +--- +node_exporter_bin_path: /usr/bin diff --git a/roles/node_exporter/handlers/main.yml b/roles/node_exporter/handlers/main.yml new file mode 100644 index 0000000..ed97d53 --- /dev/null +++ b/roles/node_exporter/handlers/main.yml @@ -0,0 +1 @@ +--- diff --git a/roles/node_exporter/meta/main.yml b/roles/node_exporter/meta/main.yml new file mode 100644 index 0000000..885b94c --- /dev/null +++ b/roles/node_exporter/meta/main.yml @@ -0,0 +1,17 @@ +--- +galaxy_info: + role_name: node_exporter + namespace: genlab + author: "Alexander Gorelyshev" + company: "Genlab, LLC" + description: "Deploy prometheus/node_exporter binary as a systemd unit" + license: "GPL-2.0-or-later" + min_ansible_version: "2.1" + + platforms: + - name: "Ubuntu" + versions: ["focal", "jammy"] + + galaxy_tags: ["prometheus"] + +dependencies: [] diff --git a/roles/node_exporter/molecule/default/converge.yml b/roles/node_exporter/molecule/default/converge.yml new file mode 100644 index 0000000..e0158f0 --- /dev/null +++ b/roles/node_exporter/molecule/default/converge.yml @@ -0,0 +1,6 @@ +--- +- name: Converge + hosts: all + roles: + - role: genlab.common.node_exporter + node_exporter_ver: "1.10.1" diff --git a/roles/node_exporter/molecule/default/molecule.yml b/roles/node_exporter/molecule/default/molecule.yml new file mode 100644 index 0000000..d82158e --- /dev/null +++ b/roles/node_exporter/molecule/default/molecule.yml @@ -0,0 +1,27 @@ +--- +dependency: + name: galaxy + +driver: + name: docker + +platforms: + - name: ubuntu + image: geerlingguy/docker-${MOLECULE_DISTRO:-ubuntu2404}-ansible:latest + pre_build_image: true + command: ${MOLECULE_DOCKER_COMMAND:-""} + volumes: + - /sys/fs/cgroup:/sys/fs/cgroup:rw + cgroupns_mode: host + privileged: true + +provisioner: + name: ansible + +verifier: + name: ansible + +lint: | + set -e + yamllint . + ansible-lint . diff --git a/roles/node_exporter/molecule/default/verify.yml b/roles/node_exporter/molecule/default/verify.yml new file mode 100644 index 0000000..b923a42 --- /dev/null +++ b/roles/node_exporter/molecule/default/verify.yml @@ -0,0 +1,15 @@ +--- +- name: Verify + hosts: all + gather_facts: false + any_errors_fatal: true + tasks: + + - name: "Sanity check the node exporter" + retries: 5 + delay: 1 + register: result + failed_when: '"node_exporter_build_info" not in result.content' + ansible.builtin.uri: + url: "http://localhost:9100/metrics" + return_content: true diff --git a/roles/node_exporter/tasks/install.yml b/roles/node_exporter/tasks/install.yml new file mode 100644 index 0000000..7a0ab83 --- /dev/null +++ b/roles/node_exporter/tasks/install.yml @@ -0,0 +1,37 @@ +--- +- name: "Install | Check if node_exporter is accessible from $PATH" + changed_when: false + failed_when: false + register: cmd_node_exporter + ansible.builtin.command: + cmd: node_exporter --version + +- name: "Install | Build the exporter name" + when: "node_exporter_ver not in cmd_node_exporter.stdout" + ansible.builtin.set_fact: + prom_exp_name: "/node_exporter-{{ node_exporter_ver }}\ + .{{ ansible_system | lower }}-\ + {{ (ansible_architecture == 'x86_64') | ternary('amd64', ansible_architecture) }}" + +- name: "Install | Download the node_exporter binary (release {{ node_exporter_ver }})" + when: "node_exporter_ver not in cmd_node_exporter.stdout" + ansible.builtin.unarchive: + src: "\ + https://github.com/prometheus/node_exporter/releases/download/\ + v{{ node_exporter_ver }}\ + {{ prom_exp_name }}\ + .tar.gz" + dest: /tmp + remote_src: true + +- name: "Install | Install the downloaded binary to '{{ node_exporter_bin_path }}'" + when: "node_exporter_ver not in cmd_node_exporter.stdout" + changed_when: false + ansible.builtin.command: + cmd: install /tmp/{{ prom_exp_name }}/node_exporter -t {{ node_exporter_bin_path }} + +- name: "Install | Push the service file template" + ansible.builtin.template: + src: node_exporter.service.j2 + dest: /usr/lib/systemd/system/node_exporter.service + mode: "0660" diff --git a/roles/node_exporter/tasks/main.yml b/roles/node_exporter/tasks/main.yml new file mode 100644 index 0000000..b63f5a3 --- /dev/null +++ b/roles/node_exporter/tasks/main.yml @@ -0,0 +1,6 @@ +--- +- name: "Include installation tasks" + ansible.builtin.include_tasks: "install.yml" + +- name: "Including run tasks" + ansible.builtin.include_tasks: "run.yml" diff --git a/roles/node_exporter/tasks/run.yml b/roles/node_exporter/tasks/run.yml new file mode 100644 index 0000000..2d71c2e --- /dev/null +++ b/roles/node_exporter/tasks/run.yml @@ -0,0 +1,8 @@ +--- +- name: "Enable and start the node_exporter service" + changed_when: false + ansible.builtin.systemd: + name: node_exporter + enabled: true + daemon_reload: true + state: restarted diff --git a/roles/node_exporter/templates/node_exporter.service.j2 b/roles/node_exporter/templates/node_exporter.service.j2 new file mode 100644 index 0000000..414c5c6 --- /dev/null +++ b/roles/node_exporter/templates/node_exporter.service.j2 @@ -0,0 +1,12 @@ +[Unit] +Description=Node Exporter +After=network.target + +[Service] +Type=simple +ExecStart={{ node_exporter_bin_path }}/node_exporter \ + --collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/) \ + --collector.systemd + +[Install] +WantedBy=multi-user.target diff --git a/roles/node_exporter/vars/main.yml b/roles/node_exporter/vars/main.yml new file mode 100644 index 0000000..ed97d53 --- /dev/null +++ b/roles/node_exporter/vars/main.yml @@ -0,0 +1 @@ +--- From 29ca89ed93ec834589b0ea66c3d44e077910e0c1 Mon Sep 17 00:00:00 2001 From: Alexander Gorelyshev Date: Wed, 17 Dec 2025 12:38:30 +0400 Subject: [PATCH 2/5] Disable an irrelevant KICS warning about unsafe URLs --- roles/node_exporter/molecule/default/verify.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/roles/node_exporter/molecule/default/verify.yml b/roles/node_exporter/molecule/default/verify.yml index b923a42..e04b1a0 100644 --- a/roles/node_exporter/molecule/default/verify.yml +++ b/roles/node_exporter/molecule/default/verify.yml @@ -1,10 +1,11 @@ +# kics-scan-disable=2e8d4922-8362-4606-8c14-aa10466a1ce3 --- - name: Verify hosts: all gather_facts: false any_errors_fatal: true + tasks: - - name: "Sanity check the node exporter" retries: 5 delay: 1 From 3ea70738962425ec345b4189735a6199512031bb Mon Sep 17 00:00:00 2001 From: Alexander Gorelyshev Date: Wed, 17 Dec 2025 12:38:44 +0400 Subject: [PATCH 3/5] Rename variables according to the convention --- roles/node_exporter/tasks/install.yml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/roles/node_exporter/tasks/install.yml b/roles/node_exporter/tasks/install.yml index 7a0ab83..aaff138 100644 --- a/roles/node_exporter/tasks/install.yml +++ b/roles/node_exporter/tasks/install.yml @@ -2,33 +2,33 @@ - name: "Install | Check if node_exporter is accessible from $PATH" changed_when: false failed_when: false - register: cmd_node_exporter + register: node_exporter_cmd ansible.builtin.command: cmd: node_exporter --version - name: "Install | Build the exporter name" - when: "node_exporter_ver not in cmd_node_exporter.stdout" + when: "node_exporter_ver not in node_exporter_cmd.stdout" ansible.builtin.set_fact: - prom_exp_name: "/node_exporter-{{ node_exporter_ver }}\ + node_exporter_name: "/node_exporter-{{ node_exporter_ver }}\ .{{ ansible_system | lower }}-\ {{ (ansible_architecture == 'x86_64') | ternary('amd64', ansible_architecture) }}" - name: "Install | Download the node_exporter binary (release {{ node_exporter_ver }})" - when: "node_exporter_ver not in cmd_node_exporter.stdout" + when: "node_exporter_ver not in node_exporter_cmd.stdout" ansible.builtin.unarchive: src: "\ https://github.com/prometheus/node_exporter/releases/download/\ v{{ node_exporter_ver }}\ - {{ prom_exp_name }}\ + {{ node_exporter_name }}\ .tar.gz" dest: /tmp remote_src: true - name: "Install | Install the downloaded binary to '{{ node_exporter_bin_path }}'" - when: "node_exporter_ver not in cmd_node_exporter.stdout" + when: "node_exporter_ver not in node_exporter_cmd.stdout" changed_when: false ansible.builtin.command: - cmd: install /tmp/{{ prom_exp_name }}/node_exporter -t {{ node_exporter_bin_path }} + cmd: install /tmp/{{ node_exporter_name }}/node_exporter -t {{ node_exporter_bin_path }} - name: "Install | Push the service file template" ansible.builtin.template: From c6f604fcc65a58c0cb4c377002c71430645d2e26 Mon Sep 17 00:00:00 2001 From: Alexander Gorelyshev Date: Wed, 17 Dec 2025 13:47:47 +0400 Subject: [PATCH 4/5] Add more linting fixes --- roles/node_exporter/molecule/default/verify.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/roles/node_exporter/molecule/default/verify.yml b/roles/node_exporter/molecule/default/verify.yml index e04b1a0..5687a6d 100644 --- a/roles/node_exporter/molecule/default/verify.yml +++ b/roles/node_exporter/molecule/default/verify.yml @@ -4,13 +4,13 @@ hosts: all gather_facts: false any_errors_fatal: true - + tasks: - name: "Sanity check the node exporter" retries: 5 delay: 1 - register: result - failed_when: '"node_exporter_build_info" not in result.content' + register: node_exporter_check + failed_when: '"node_exporter_build_info" not in node_exporter_check.content' ansible.builtin.uri: url: "http://localhost:9100/metrics" return_content: true From a5b6f0ff75520b115f11cdf329c469552bfef326 Mon Sep 17 00:00:00 2001 From: Alexander Gorelyshev Date: Wed, 17 Dec 2025 13:48:15 +0400 Subject: [PATCH 5/5] Fix KICS rule disabling syntax --- roles/node_exporter/molecule/default/verify.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/node_exporter/molecule/default/verify.yml b/roles/node_exporter/molecule/default/verify.yml index 5687a6d..3f1bb0b 100644 --- a/roles/node_exporter/molecule/default/verify.yml +++ b/roles/node_exporter/molecule/default/verify.yml @@ -1,4 +1,4 @@ -# kics-scan-disable=2e8d4922-8362-4606-8c14-aa10466a1ce3 +# kics-scan disable=2e8d4922-8362-4606-8c14-aa10466a1ce3 --- - name: Verify hosts: all