add nginx and open firewall port

manifests/profile/kubernetes/destination_port/prometheus.pp

@@ -0,0 +1,14 @@
+# Copyright (c) 2024 The Regents of the University of Michigan.
+# All Rights Reserved. Licensed according to the terms of the Revised
+# BSD License. See LICENSE.txt for details.
+
+class nebula::profile::kubernetes::destination_port::prometheus {
+  $cluster_name = lookup('nebula::profile::kubernetes::cluster')
+
+  @@concat_fragment { "haproxy kubernetes prometheus ${::hostname}":
+    target  => '/etc/haproxy/services.d/prometheus.cfg',
+    order   => '02',
+    content => "  server ${::hostname} ${::ipaddress}:443 check send-proxy\n",
+    tag     => "${cluster_name}_haproxy_kubernetes_prometheus",
+  }
+}

manifests/profile/kubernetes/haproxy.pp

@@ -34,7 +34,7 @@
     notify  => Service['haproxy'],
   }
 
-  ['api', 'etcd', 'gelf_tcp', 'http', 'https', 'https_alt'].each |$service| {
+  ['api', 'etcd', 'gelf_tcp', 'http', 'https', 'https_alt', 'prometheus'].each |$service| {
     concat { "/etc/haproxy/services.d/${service}.cfg":
       notify => Service['haproxy'],
     }
@@ -72,6 +72,10 @@
     '200 public https':
       dport => 443,
     ;
+
+    '200 client cert prometheus https':
+      dport => 9090,
+    ;
   }
 
   nebula::exposed_port { '200 private https_alt':

manifests/profile/prometheus.pp

@@ -146,6 +146,30 @@
       port  => 443,
       block => 'umich::networks::all_trusted_machines',
     }
+  } else {
+    class { 'nginx':
+      server_tokens        => 'off',
+    }
+    nginx::resource::server { 'https-forwarder':
+      server_name          => [$::fqdn],
+      listen_options       => "proxy_protocol default_server",
+      listen_port          => 443,
+      proxy                => "http://localhost:9090",
+      ssl                  => true,
+      ssl_cert             => "/etc/prometheus/tls/client.crt",
+      ssl_key              => "/etc/prometheus/tls/client.key",
+      server_cfg_append    => {
+        'ssl_client_certificate' => '/etc/prometheus/tls/ca.crt',
+        'ssl_verify_client'      => 'on',
+        'ssl_verify_depth'       => 1,
+      },
+    }
+    firewall { "200 HTTPS: Client Cert":
+      proto  => 'tcp',
+      dport  => [443],
+      state  => 'NEW',
+      action => 'accept',
+    }
   }
 
   # Delete this once nothing is importing it. It's only here for the

manifests/role/kubernetes/prometheus.pp

@@ -6,6 +6,7 @@
   include nebula::role::prometheus
   include nebula::profile::unattended_upgrades
   include nebula::profile::kubernetes::dns_client
+  include nebula::profile::kubernetes::destination_port::prometheus
   class { 'nebula::profile::kubernetes::kubelet':
     install_kubelet => false,
   }

templates/profile/kubernetes/haproxy/services.d/prometheus.cfg.erb

@@ -0,0 +1,11 @@
+# Managed by puppet (nebula/profile/kubernetes/haproxy/services.d/prometheus.cfg.erb)
+frontend kubernetes-prometheus-front
+  bind <%= @public_address %>:9090
+  mode tcp
+  option tcplog
+  default_backend kubernetes-prometheus-back
+
+backend kubernetes-prometheus-back
+  mode tcp
+  option tcp-check
+  balance roundrobin