Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enable insecure_skip_verify for kubelet scraping #726

Closed
pintohutch opened this issue Dec 20, 2023 · 2 comments
Closed

Enable insecure_skip_verify for kubelet scraping #726

pintohutch opened this issue Dec 20, 2023 · 2 comments
Assignees

Comments

@pintohutch
Copy link
Collaborator

We currently hardcode the scrape config for kubelet scraping. The configuration defaults to verifying the target certificate over https by leaving insecure_skip_verify as false.

However, this can result in errors on K8s clusters where nodes are not provisioned certificates to include the IP address in the certificate SAN field:

Get "https://10.223.3.45:10250/metrics/cadvisor": tls: failed to verify certificate: x509: cannot validate certificate for 10.223.3.45 because it doesn't contain any IP SAN

We should either:

  1. Expose this field as a configuration option for kubelet scraping in the OperatorConfig, e.g.
collection:
  kubeletScraping:
    interval: 30s
    tlsSkipVerify: true
  1. Change the default behavior to set insecure_skip_verify: true in the hardcoded config.
@pintohutch
Copy link
Collaborator Author

Actually looks like this is a duplicate of #223.

@pintohutch
Copy link
Collaborator Author

I'll just close this then and refer to that.

@pintohutch pintohutch reopened this Dec 20, 2023
@pintohutch pintohutch closed this as not planned Won't fix, can't repro, duplicate, stale Dec 20, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants