feat(mon/synology): scrape DS1821+ via snmp_exporter

kubernetes-monitoring/apps/snmp-exporter/deployment.yaml

@@ -0,0 +1,69 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: snmp-exporter
+  namespace: monitoring
+  labels:
+    app.kubernetes.io/name: snmp-exporter
+    app.kubernetes.io/instance: snmp-exporter
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: snmp-exporter
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: snmp-exporter
+        app.kubernetes.io/instance: snmp-exporter
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
+        runAsGroup: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: snmp-exporter
+          image: quay.io/prometheus/snmp-exporter:v0.30.1
+          args:
+            # Stock config baked into the image — it already ships the `synology` module.
+            - "--config.file=/etc/snmp_exporter/snmp.yml"
+            # Our SNMPv3 credentials; snmp_exporter merges multiple --config.file flags.
+            - "--config.file=/etc/snmp/auth.yml"
+          ports:
+            - name: metrics
+              containerPort: 9116
+              protocol: TCP
+          volumeMounts:
+            - name: auth
+              mountPath: /etc/snmp
+              readOnly: true
+          readinessProbe:
+            httpGet:
+              path: /
+              port: metrics
+            initialDelaySeconds: 5
+            periodSeconds: 15
+          livenessProbe:
+            httpGet:
+              path: /
+              port: metrics
+            initialDelaySeconds: 15
+            periodSeconds: 30
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              memory: 128Mi
+      volumes:
+        - name: auth
+          secret:
+            secretName: snmp-exporter-auth

kubernetes-monitoring/apps/snmp-exporter/secret.sops.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: snmp-exporter-auth
+    namespace: monitoring
+type: Opaque
+stringData:
+    auth.yml: ENC[AES256_GCM,data:/UESrSn3ezINnFou7hiXYrqECjStumoIXBQm2q9Gxe9QaCg5AI5dl+ZNAgo+1YIrQbf1BrQgZttXjSAMn+Rf6nDhOEu44i1AbbZKXT6bm3fzuEzPcT5EIf5BQuGpnwXmpy3Gh+5Zi/fs0xO/cSlIiEkagNV7BO40Nl9ktUt4zKyW9GI/zf/T4iTUTlLWqSogDBE59gnBXa9fvNuHx8jIufpzhnnk65keoybEewW3/00Sa9Q+J31VvQ/w3DC205aad1njU8PIP5jPAn97pQeSZPY9iNNexxpb0+5IdSHpcKlT1aEigR8TqYc/,iv:4D6jFm9mA9BglHqsvTrrYxtYus1JWmCWEu0HQALET+4=,tag:It3uGYRvYPCL4+xvFo7P0A==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzdUFHTFFjMXpzbFAyN00x
+            N0FrRHJnT2ljYThUcndHNGIyK1RJOWp5Z3c0CnFNQzkzZk5NWDgwN3ZiRTBjYU9S
+            SFpkTmJkM2VLbEJzZEtxYy9DVFB6OXcKLS0tIFZzWTZNOFNXRzdERGFWanZTYkp1
+            R2dvMmhBTjQyOS85UzIxYlN0Wm8wU1EKmWA+lkDNqzpyqEd+PpI6PDi9L/Vlp1RP
+            Y6WVvvOi9OKc4UaDxXVSEgLlA3DNBg2BaY2jEhMJlqLJyknHY4un0g==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1jetw4h63gq4uzyk08znynw4h852nexdmtkdz4kwxj5ew5st32vnspmtag2
+    encrypted_regex: ^(data|stringData|email)$
+    lastmodified: "2026-06-29T11:52:50Z"
+    mac: ENC[AES256_GCM,data:/zoY3ZS7ipOjt1YY2OQ5SCRITX9WXI+BXmrmlRfoJ9M+lJHomgbTkdqu70jcgYXTm/ARlTMrMrk3zCQqPBPc9bYbz7wXh8o0PLyCUQ1ccSGR5hWjywsRjm7nfM25p0UYvEllj+KywRnY7ArbJvzGcLYEtHmUvuyRs2HG5Tv7KnM=,iv:je3IVh8HpLzRGToU5Znuq49K2H+hxEM94WCP1c39mjg=,tag:sf6USL4a2/vZXQT7eMerBA==,type:str]
+    version: 3.13.1

kubernetes-monitoring/apps/snmp-exporter/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: snmp-exporter
+  namespace: monitoring
+  labels:
+    app.kubernetes.io/name: snmp-exporter
+    app.kubernetes.io/instance: snmp-exporter
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: snmp-exporter
+  ports:
+    - name: metrics
+      port: 9116
+      targetPort: metrics
+      protocol: TCP

kubernetes-monitoring/apps/snmp-exporter/vmstaticscrape-synology.yaml

@@ -0,0 +1,31 @@
+apiVersion: operator.victoriametrics.com/v1beta1
+kind: VMStaticScrape
+metadata:
+  name: synology
+  namespace: monitoring
+  labels:
+    app.kubernetes.io/name: snmp-exporter
+spec:
+  jobName: synology
+  targetEndpoints:
+    # snmp_exporter is a proxy: vmagent scrapes the exporter, which then queries
+    # the NAS over SNMP. The device address is passed as the `target` param and
+    # the request is redirected to the exporter Service via relabeling below.
+    - targets:
+        - "synology.storage.lviv"
+      scheme: http
+      path: /snmp
+      params:
+        module:
+          - synology
+        auth:
+          - synology_v3
+      interval: 60s
+      scrapeTimeout: 30s
+      relabelConfigs:
+        - sourceLabels: [__address__]
+          targetLabel: __param_target
+        - sourceLabels: [__param_target]
+          targetLabel: instance
+        - targetLabel: __address__
+          replacement: snmp-exporter.monitoring.svc:9116