titan-iac/services/monitoring/postmark-exporter-deployment.yaml

# services/monitoring/postmark-exporter-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: postmark-exporter
spec:
  replicas: 1
  selector:
    matchLabels:
      app: postmark-exporter
  template:
    metadata:
      labels:
        app: postmark-exporter
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "8000"
        prometheus.io/path: "/metrics"
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/role: "monitoring"
        vault.hashicorp.com/agent-inject-secret-postmark-env: "kv/data/atlas/shared/postmark-relay"
        vault.hashicorp.com/agent-inject-template-postmark-env: |
          {{- with secret "kv/data/atlas/shared/postmark-relay" -}}
          export POSTMARK_SERVER_TOKEN="{{ index .Data.data "apikey" }}"
          export POSTMARK_SERVER_TOKEN_FALLBACK="{{ index .Data.data "apikey" }}"
          {{- if index .Data.data "sending-limit" }}
          export POSTMARK_SENDING_LIMIT="{{ index .Data.data "sending-limit" }}"
          {{- end }}
          {{- end -}}
        bstein.dev/restarted-at: "2026-01-06T00:00:00Z"
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: kubernetes.io/hostname
                    operator: NotIn
                    values:
                      - titan-22
      serviceAccountName: monitoring-vault-sync
      containers:
        - name: exporter
          image: python:3.12-alpine
          imagePullPolicy: IfNotPresent
          command: ["/bin/sh", "-c"]
          args:
            - |
              set -euo pipefail
              . /vault/secrets/postmark-env
              pip install --no-cache-dir prometheus-client==0.22.1 requests==2.32.3
              exec python /app/monitoring_postmark_exporter.py
          env:
            - name: POSTMARK_SENDING_LIMIT_WINDOW
              value: "30d"
            - name: POLL_INTERVAL_SECONDS
              value: "60"
            - name: LISTEN_PORT
              value: "8000"
          ports:
            - name: http
              containerPort: 8000
          volumeMounts:
            - name: script
              mountPath: /app
              readOnly: true
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 250m
              memory: 256Mi
      volumes:
        - name: script
          configMap:
            name: postmark-exporter-script