From 3c7f982b4f03976d4f354e2dee0331c2cf877194 Mon Sep 17 00:00:00 2001 From: clsau <35257830+clsau@users.noreply.github.com> Date: Fri, 5 Jul 2019 17:02:36 +0100 Subject: [PATCH] Adding TLS params to kube controller manager and kube scheduler (#15277) Signed-off-by: Clarisse Sauvage --- stable/prometheus-operator/Chart.yaml | 2 +- stable/prometheus-operator/README.md | 4 ++++ stable/prometheus-operator/ci/test-values.yaml | 12 ++++++++++++ .../kube-controller-manager/servicemonitor.yaml | 6 ++++++ .../exporters/kube-scheduler/servicemonitor.yaml | 6 ++++++ stable/prometheus-operator/values.yaml | 12 ++++++++++++ 6 files changed, 41 insertions(+), 1 deletion(-) diff --git a/stable/prometheus-operator/Chart.yaml b/stable/prometheus-operator/Chart.yaml index 925264fb28..038e293c0b 100644 --- a/stable/prometheus-operator/Chart.yaml +++ b/stable/prometheus-operator/Chart.yaml @@ -11,7 +11,7 @@ name: prometheus-operator sources: - https://github.com/coreos/prometheus-operator - https://coreos.com/operators/prometheus -version: 5.14.1 +version: 5.15.0 appVersion: 0.31.1 home: https://github.com/coreos/prometheus-operator keywords: diff --git a/stable/prometheus-operator/README.md b/stable/prometheus-operator/README.md index e8df0d91d6..80d623adb9 100644 --- a/stable/prometheus-operator/README.md +++ b/stable/prometheus-operator/README.md @@ -355,6 +355,8 @@ The following tables list the configurable parameters of the prometheus-operator | `kubeControllermanager.service.targetPort` | Controller-manager targetPort for the service runs on | `10252` | | `kubeControllermanager.service.selector` | Controller-manager service selector | `{"component" : "kube-controller-manager" }` | | `kubeControllermanager.serviceMonitor.https` | Controller-manager service scrape over https | `false` | +| `kubeControllermanager.serviceMonitor.serverName` | Name of the server to use when validating TLS certificate | `null` | +| `kubeControllermanager.serviceMonitor.insecureSkipVerify` | Skip TLS certificate validation when scraping | `null` | | `kubeControllermanager.serviceMonitor.interval` | Scrape interval. If not set, the Prometheus default scrape interval is used | `nil` | | `kubeControllermanager.serviceMonitor.metricRelabelings` | The `metric_relabel_configs` for scraping the scheduler. | `` | | `kubeControllermanager.serviceMonitor.relabelings` | The `relabel_configs` for scraping the scheduler. | `` | @@ -390,6 +392,8 @@ The following tables list the configurable parameters of the prometheus-operator | `kubeScheduler.service.targetPort` | Scheduler targetPort for the service runs on | `10251` | | `kubeScheduler.service.selector` | Scheduler service selector | `{"component" : "kube-scheduler" }` | | `kubeScheduler.serviceMonitor.https` | Scheduler service scrape over https | `false` | +| `kubeScheduler.serviceMonitor.serverName` | Name of the server to use when validating TLS certificate | `null` | +| `kubeScheduler.serviceMonitor.insecureSkipVerify` | Skip TLS certificate validation when scraping | `null` | | `kubeScheduler.serviceMonitor.interval` | Scrape interval. If not set, the Prometheus default scrape interval is used | `nil` | | `kubeScheduler.serviceMonitor.metricRelabelings` | The `metric_relabel_configs` for scraping the Kubernetes scheduler. | `` | | `kubeScheduler.serviceMonitor.relabelings` | The `relabel_configs` for scraping the Kubernetes scheduler. | `` | diff --git a/stable/prometheus-operator/ci/test-values.yaml b/stable/prometheus-operator/ci/test-values.yaml index 1bf6d2a464..0e3ba2a1ac 100644 --- a/stable/prometheus-operator/ci/test-values.yaml +++ b/stable/prometheus-operator/ci/test-values.yaml @@ -589,6 +589,12 @@ kubeControllerManager: ## https: false + # Skip TLS certificate validation when scraping + insecureSkipVerify: null + + # Name of the server to use when validating TLS certificate + serverName: null + ## metric relabel configs to apply to samples before ingestion. ## metricRelabelings: [] @@ -755,6 +761,12 @@ kubeScheduler: ## https: false + ## Skip TLS certificate validation when scraping + insecureSkipVerify: null + + ## Name of the server to use when validating TLS certificate + serverName: null + ## metric relabel configs to apply to samples before ingestion. ## metricRelabelings: [] diff --git a/stable/prometheus-operator/templates/exporters/kube-controller-manager/servicemonitor.yaml b/stable/prometheus-operator/templates/exporters/kube-controller-manager/servicemonitor.yaml index 2b6cad76c6..2f1ecab27a 100644 --- a/stable/prometheus-operator/templates/exporters/kube-controller-manager/servicemonitor.yaml +++ b/stable/prometheus-operator/templates/exporters/kube-controller-manager/servicemonitor.yaml @@ -25,6 +25,12 @@ spec: scheme: https tlsConfig: caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt + {{- if .Values.kubeControllerManager.serviceMonitor.insecureSkipVerify }} + insecureSkipVerify: {{ .Values.kubeControllerManager.serviceMonitor.insecureSkipVerify }} + {{- end }} + {{- if .Values.kubeControllerManager.serviceMonitor.serverName }} + serverName: {{ .Values.kubeControllerManager.serviceMonitor.serverName }} + {{- end }} {{- end }} {{- if .Values.kubeControllerManager.serviceMonitor.metricRelabelings }} metricRelabelings: diff --git a/stable/prometheus-operator/templates/exporters/kube-scheduler/servicemonitor.yaml b/stable/prometheus-operator/templates/exporters/kube-scheduler/servicemonitor.yaml index 7e62c2910c..c2a7c74ac7 100644 --- a/stable/prometheus-operator/templates/exporters/kube-scheduler/servicemonitor.yaml +++ b/stable/prometheus-operator/templates/exporters/kube-scheduler/servicemonitor.yaml @@ -25,6 +25,12 @@ spec: scheme: https tlsConfig: caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt + {{- if .Values.kubeScheduler.serviceMonitor.insecureSkipVerify }} + insecureSkipVerify: {{ .Values.kubeScheduler.serviceMonitor.insecureSkipVerify }} + {{- end}} + {{- if .Values.kubeScheduler.serviceMonitor.serverName }} + serverName: {{ .Values.kubeScheduler.serviceMonitor.serverName }} + {{- end}} {{- end}} {{- if .Values.kubeScheduler.serviceMonitor.metricRelabelings }} metricRelabelings: diff --git a/stable/prometheus-operator/values.yaml b/stable/prometheus-operator/values.yaml index 987b1c949a..a57ec04dee 100644 --- a/stable/prometheus-operator/values.yaml +++ b/stable/prometheus-operator/values.yaml @@ -589,6 +589,12 @@ kubeControllerManager: ## https: false + # Skip TLS certificate validation when scraping + insecureSkipVerify: null + + # Name of the server to use when validating TLS certificate + serverName: null + ## metric relabel configs to apply to samples before ingestion. ## metricRelabelings: [] @@ -755,6 +761,12 @@ kubeScheduler: ## https: false + ## Skip TLS certificate validation when scraping + insecureSkipVerify: null + + ## Name of the server to use when validating TLS certificate + serverName: null + ## metric relabel configs to apply to samples before ingestion. ## metricRelabelings: []