configure haproxy for prometheus

manifests/profile/kubernetes/destination_port/prometheus.pp

@@ -0,0 +1,14 @@
+# Copyright (c) 2024 The Regents of the University of Michigan.
+# All Rights Reserved. Licensed according to the terms of the Revised
+# BSD License. See LICENSE.txt for details.
+
+class nebula::profile::kubernetes::destination_port::prometheus {
+  $cluster_name = lookup('nebula::profile::kubernetes::cluster')
+
+  @@concat_fragment { "haproxy kubernetes prometheus ${::hostname}":
+    target  => '/etc/haproxy/services.d/prometheus.cfg',
+    order   => '02',
+    content => "  server ${::hostname} ${::ipaddress}:443 check send-proxy\n",
+    tag     => "${cluster_name}_haproxy_kubernetes_prometheus",
+  }
+}

manifests/profile/kubernetes/haproxy.pp

@@ -34,7 +34,7 @@
     notify  => Service['haproxy'],
   }
 
-  ['api', 'etcd', 'gelf_tcp', 'http', 'https', 'https_alt'].each |$service| {
+  ['api', 'etcd', 'gelf_tcp', 'http', 'https', 'https_alt', 'prometheus'].each |$service| {
     concat { "/etc/haproxy/services.d/${service}.cfg":
       notify => Service['haproxy'],
     }
@@ -72,6 +72,10 @@
     '200 public https':
       dport => 443,
     ;
+
+    '200 client cert prometheus https':
+      dport => 9090,
+    ;
   }
 
   nebula::exposed_port { '200 private https_alt':

manifests/role/kubernetes/prometheus.pp

@@ -6,6 +6,7 @@
   include nebula::role::prometheus
   include nebula::profile::unattended_upgrades
   include nebula::profile::kubernetes::dns_client
+  include nebula::profile::kubernetes::destination_port::prometheus
   class { 'nebula::profile::kubernetes::kubelet':
     install_kubelet => false,
   }

templates/profile/kubernetes/haproxy/services.d/prometheus.cfg.erb

@@ -0,0 +1,11 @@
+# Managed by puppet (nebula/profile/kubernetes/haproxy/services.d/prometheus.cfg.erb)
+frontend kubernetes-prometheus-front
+  bind <%= @public_address %>:9090
+  mode tcp
+  option tcplog
+  default_backend kubernetes-prometheus-back
+
+backend kubernetes-prometheus-back
+  mode tcp
+  option tcp-check
+  balance roundrobin