Move the security rule for the postgresql exporter into the postgresql module.

modules/postgresql/postgresql.tf

@@ -90,6 +90,32 @@ resource "openstack_networking_secgroup_rule_v2" "postgresql_ingress_bootpc" {
   port_range_max    = 68
 }
 
+#
+# Monitoring: the Prometheus postgres_exporter, installed on the server by the
+# postgresql role (see infrastructure-playbooks, postgresql-cloud.yml).
+#
+# It is a group of its own, on the MAIN network port, because that is where the
+# exporter is scraped from: the two groups above live on the service port, in
+# the dedicated database network, which Prometheus has no reason to join. Only
+# the server gets it, so nothing else in the project has 9187 opened.
+#
+resource "openstack_networking_secgroup_v2" "postgresql_monitoring" {
+  name                 = "prometheus_access_to_the_postgresql_exporter"
+  delete_default_rules = "true"
+  description          = "Prometheus access to the postgres_exporter of the PostgreSQL server"
+}
+
+resource "openstack_networking_secgroup_rule_v2" "postgresql_exporter_ingress" {
+  security_group_id = openstack_networking_secgroup_v2.postgresql_monitoring.id
+  description       = "Connections to the postgres_exporter port ${var.postgresql_data.exporter_port} from Prometheus"
+  direction         = "ingress"
+  ethertype         = "IPv4"
+  protocol          = "tcp"
+  port_range_min    = var.postgresql_data.exporter_port
+  port_range_max    = var.postgresql_data.exporter_port
+  remote_ip_prefix  = var.prometheus_cidr
+}
+
 #
 # Security group of the clients: it goes on the port that every client of the
 # database has on the dedicated network
@@ -164,11 +190,16 @@ resource "openstack_blockstorage_volume_v3" "postgresql_wal_vol" {
 # security groups do not depend on the life cycle of the VM
 #
 resource "openstack_networking_port_v2" "postgresql_main_port" {
-  name               = "${var.postgresql_data.name}-main-port"
-  description        = "Administration port of the PostgreSQL server on the main private network"
-  admin_state_up     = true
-  network_id         = var.main_private_network_id
-  security_group_ids = [var.default_security_group_id]
+  name           = "${var.postgresql_data.name}-main-port"
+  description    = "Administration port of the PostgreSQL server on the main private network"
+  admin_state_up = true
+  network_id     = var.main_private_network_id
+  # The default group carries SSH from the jump proxy, ICMP, the node exporter
+  # and the egress rule; the monitoring one adds the postgres_exporter port
+  security_group_ids = [
+    var.default_security_group_id,
+    openstack_networking_secgroup_v2.postgresql_monitoring.id,
+  ]
   fixed_ip {
     subnet_id  = var.main_private_subnet_id
     ip_address = var.postgresql_main_ip

modules/postgresql/variables-postgresql.tf

@@ -31,6 +31,10 @@ variable "postgresql_data" {
     allocation_pool_end   = optional(string, "192.168.3.254")
     # Port the service listens on
     port = optional(number, 5432)
+    # Port of the Prometheus postgres_exporter, on the MAIN network: the
+    # exporter is monitoring, not database traffic, and it is scraped over the
+    # administration interface
+    exporter_port = optional(number, 9187)
     # Data and WAL volumes. m1.large is RAM 8 - VCPUs 4
     vol_data_name   = optional(string, "postgresql-data")
     vol_data_size   = optional(number, 100)
@@ -49,6 +53,14 @@ variable "postgresql_main_ip" {
   description = "Address of the server on the main private network, used for the administration (ansible, monitoring, backups)"
 }
 
+# Also part of the address plan of the project, same rationale: it is the
+# address of a shared service, so it is declared once in s2i2s/variables and
+# passed in, instead of being duplicated as a module default
+variable "prometheus_cidr" {
+  type        = string
+  description = "CIDR of the Prometheus server, the only source allowed to reach the postgres_exporter"
+}
+
 # Data that comes from the network/DNS and project setup workspaces
 variable "main_private_network_id" {
   type        = string

s2i2s/postgresql/main.tf

@@ -66,6 +66,7 @@ module "postgresql" {
   # Address plan of the project. The sizing and the dedicated network come from
   # the module defaults
   postgresql_main_ip = local.basic_services_ip.postgresql
+  prometheus_cidr    = local.basic_services_ip.prometheus_cidr
 
   main_private_network_id   = local.main_private_network_id
   main_private_subnet_id    = local.main_private_subnet_id

s2i2s/project-setup/security-groups.tf

@@ -43,26 +43,6 @@ resource "openstack_networking_secgroup_rule_v2" "prometheus-node" {
   remote_ip_prefix  = local.basic_services_ip.prometheus_cidr
 }
 
-# postgres_exporter, installed by the postgresql role on the database server
-# (see infrastructure-playbooks, postgresql-cloud.yml).
-#
-# In the DEFAULT security group and not in modules/postgresql on purpose: the
-# address Prometheus scrapes is the one on the main private network, and that
-# port carries the default security group only - the groups of the module are
-# attached to the service port, on the dedicated database network. Same reason,
-# and same shape, as the node exporter rule above: the source is a single host,
-# and a VM that does not run the exporter has nothing listening on 9187.
-resource "openstack_networking_secgroup_rule_v2" "prometheus-postgres-exporter" {
-  security_group_id = openstack_networking_secgroup_v2.default.id
-  description       = "Prometheus access to the postgres exporter"
-  direction         = "ingress"
-  ethertype         = "IPv4"
-  protocol          = "tcp"
-  port_range_min    = 9187
-  port_range_max    = 9187
-  remote_ip_prefix  = local.basic_services_ip.prometheus_cidr
-}
-
 #
 # SSH access to the jump proxy. Used by the jump proxy VM only
 resource "openstack_networking_secgroup_v2" "access_to_the_jump_proxy" {