# prometheus-pve-exporter — exposes Proxmox VE metrics for Prometheus.
# The API token lives in the `pve-exporter` Secret, created out-of-band (NOT in git):
#   kubectl -n monitoring create secret generic pve-exporter \
#     --from-literal=PVE_USER=monitoring@pve \
#     --from-literal=PVE_TOKEN_NAME=prometheus \
#     --from-literal=PVE_TOKEN_VALUE=<token> \
#     --from-literal=PVE_VERIFY_SSL=false
apiVersion: apps/v1
kind: Deployment
metadata:
  name: prometheus-pve-exporter
  namespace: monitoring
  labels:
    app: prometheus-pve-exporter
spec:
  replicas: 1
  selector:
    matchLabels:
      app: prometheus-pve-exporter
  template:
    metadata:
      labels:
        app: prometheus-pve-exporter
    spec:
      containers:
        - name: pve-exporter
          image: prompve/prometheus-pve-exporter:3.9.0
          envFrom:
            - secretRef:
                name: pve-exporter
          ports:
            - containerPort: 9221
              name: http
          securityContext:
            runAsNonRoot: true
            runAsUser: 1000
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
            seccompProfile:
              type: RuntimeDefault
---
apiVersion: v1
kind: Service
metadata:
  name: prometheus-pve-exporter
  namespace: monitoring
spec:
  selector:
    app: prometheus-pve-exporter
  ports:
    - port: 9221
      targetPort: 9221