feat(agent): add node exporter foundation and configuration model

[hbc (bcho)]

Summary

• extract shared node-local service address selection from LocalDNS
• add the Machine API and agent configuration model for node exporter
• add validation, deep-copy behavior, and Machine-to-agent config conversion
• add generated CRDs and the node exporter design document

Stack

• PR 1 of 3
• Next: feat(agent): run node exporter in nspawn #817

Testing

• go test ./api/machina/v1alpha3 ./cmd/agent/internal/daemon ./internal/provision ./pkg/agent/config ./pkg/agent/goalstates

[Copilot]

🟡 Changes recommended

Extra arguments can currently override node exporter filesystem roots, violating the documented isolation contract.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds the configuration foundation for running Prometheus node exporter inside agent-managed nspawn machines.

Changes:

• Adds Machine and agent configuration, conversion, validation, and deep-copy support.
• Extracts reusable node-local IPv4 address resolution from LocalDNS.
• Adds download overrides, generated CRDs, tests, and design documentation.

File summaries

File	Description
pkg/agent/goalstates/node_service_address.go	Adds shared node-service address resolution.
pkg/agent/goalstates/node_service_address_test.go	Tests address-selection behavior.
pkg/agent/goalstates/localdns.go	Migrates LocalDNS to the shared resolver.
pkg/agent/goalstates/localdns_test.go	Updates LocalDNS address tests.
pkg/agent/goalstates/downloads.go	Adds node exporter download overrides.
pkg/agent/config/nodeexporter.go	Defines and validates node exporter configuration.
pkg/agent/config/nodeexporter_test.go	Tests validation and deep-copy behavior.
pkg/agent/config/config.go	Integrates node exporter into agent configuration.
internal/provision/agent_config.go	Converts Machine API settings to agent configuration.
internal/provision/agent_config_test.go	Tests node exporter conversion.
designs/agent-node-exporter.md	Documents the proposed architecture and lifecycle.
deploy/machina/crd/unbounded-cloud.io_machines.yaml	Exposes fields in the Machine CRD.
deploy/machina/crd/unbounded-cloud.io_machineconfigurationversions.yaml	Exposes fields in version CRDs.
deploy/machina/crd/unbounded-cloud.io_machineconfigurations.yaml	Exposes fields in configuration CRDs.
cmd/agent/internal/daemon/controller_node.go	Applies versioned node exporter settings.
api/machina/v1alpha3/zz_generated.deepcopy.go	Adds generated deep-copy support.
api/machina/v1alpha3/machineconfiguration_types.go	Adds versioned node exporter configuration.
api/machina/v1alpha3/machine_types.go	Adds Machine API and download types.

Review details

Files not reviewed (1)

• api/machina/v1alpha3/zz_generated.deepcopy.go: Generated file

• Files reviewed: 17/18 changed files
• Comments generated: 4
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

Listener conflicts are not rejected, and the new configuration-template path lacks coverage.

Review details

Files not reviewed (1)

• api/machina/v1alpha3/zz_generated.deepcopy.go: Generated file

Suppressed comments (2)

Previously missed (2) — in code that hasn't changed since the last review.

pkg/agent/config/nodeexporter.go:65

• AgentConfig.Validate currently accepts listener collisions. For example, LocalDNS and node exporter can both be enabled with 10.0.0.4:9253; both validators succeed, but the services share the host network namespace, so one will fail to bind. Compare the fully resolved service endpoints before startup (including wildcard listeners such as containerd/kubelet) and reject conflicts, as required by the design's address/port contract.
  cmd/agent/internal/daemon/controller_node.go:155
• The new MachineConfiguration override path is untested. Existing repave coverage only asserts Kubernetes and image fields, so a future omission here could silently ignore versioned node exporter settings. Add a template-driven repave test that includes NodeExporter and verifies the resulting config, including copied ExtraArgs and TLS values.

• Files reviewed: 17/18 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[hbc (bcho)]

after discussion we will move the node exporter deployment to use ds for now