# Host metrics for falken (the observability host), as in the Ansible stack's
# node-exporter (pid: host, / mounted at /host). hostNetwork so network stats
# are the host's, not the pod's. Port 9100 on the host is blocked from the
# internet by falken's ufw; Prometheus reaches it through the Service.
#
# This does NOT watch czy, where Ledgerline runs.
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: node-exporter
spec:
  selector:
    matchLabels:
      app: node-exporter
  template:
    metadata:
      labels:
        app: node-exporter
    spec:
      hostPID: true
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      containers:
        - name: node-exporter
          image: prom/node-exporter:v1.9.1
          args:
            - --path.rootfs=/host
          ports:
            - containerPort: 9100
          resources:
            requests:
              cpu: 10m
              memory: 24Mi
            limits:
              memory: 96Mi
          volumeMounts:
            - name: host
              mountPath: /host
              readOnly: true
              mountPropagation: HostToContainer
      volumes:
        - name: host
          hostPath:
            path: /