github/x509-certificate-exporter
1
0
Fork 0
mirror of https://github.com/enix/x509-certificate-exporter.git synced 2026-08-19 03:56:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(chart): reject basicAuth on monitors when rbacProxy already authenticates scrapes

Browse Source
This commit is contained in:
Thibault VINCENT
2026-08-05 18:59:04 +02:00
parent 6948464240
commit 3bfe89ef96
4 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
chart/README.md
+2 -2
View File
@@ -408,7 +408,7 @@ exporter-toolkit is the recommended path on new installs.
| prometheusServiceMonitor.metricRelabelings | list | `[]` | Metric relabel config for the ServiceMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint |
| prometheusServiceMonitor.relabelings | list | `[]` | Relabel config for the ServiceMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint |
| prometheusServiceMonitor.scheme | string | `"http"` | Scheme config for the ServiceMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint |
| prometheusServiceMonitor.basicAuth | object | `{}` | BasicAuth credentials for the ServiceMonitor endpoint (Secret key selectors for `username` and `password`), see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.BasicAuth |
| prometheusServiceMonitor.basicAuth | object | `{}` | BasicAuth credentials for the ServiceMonitor endpoint (Secret key selectors for `username` and `password`). Mutually exclusive with `rbacProxy.enabled`, which authenticates scrapes with the Prometheus ServiceAccount bearer token — the chart refuses to render both. See: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.BasicAuth |
| prometheusServiceMonitor.tlsConfig | object | `{}` | Custom TLS configuration, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.TLSConfig |
| prometheusPodMonitor.create | bool | `false` | Should a PodMonitor object be installed to scrape this exporter. For prometheus-operator (kube-prometheus) users. |
| prometheusPodMonitor.scrapeInterval | string | `"60s"` | Target scrape interval set in the PodMonitor |
@@ -417,7 +417,7 @@ exporter-toolkit is the recommended path on new installs.
| prometheusPodMonitor.metricRelabelings | list | `[]` | Metric relabel config for the PodMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint |
| prometheusPodMonitor.relabelings | list | `[]` | Relabel config for the PodMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint |
| prometheusPodMonitor.scheme | string | `"http"` | Scheme config for the PodMonitor, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.Endpoint |
| prometheusPodMonitor.basicAuth | object | `{}` | BasicAuth credentials for the PodMonitor endpoint (Secret key selectors for `username` and `password`), see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.BasicAuth |
| prometheusPodMonitor.basicAuth | object | `{}` | BasicAuth credentials for the PodMonitor endpoint (Secret key selectors for `username` and `password`). Mutually exclusive with `rbacProxy.enabled`, which authenticates scrapes with the Prometheus ServiceAccount bearer token — the chart refuses to render both. See: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.BasicAuth |
| prometheusPodMonitor.tlsConfig | object | `{}` | Custom TLS configuration, see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.TLSConfig |
| prometheusRules.create | bool | `true` | Should a PrometheusRule object be installed to alert on certificate expiration. For prometheus-operator (kube-prometheus) users. |
| prometheusRules.rulePrefix | string | `""` | Prefix prepended to the alert rule names of PrometheusRule rules |
chart/templates/podmonitor.yaml
+3
View File
@@ -21,6 +21,9 @@ spec:
bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
{{- end }}
scheme: {{ .Values.prometheusPodMonitor.scheme }}
{{- if and .Values.rbacProxy.enabled .Values.prometheusPodMonitor.basicAuth }}
{{- fail "prometheusPodMonitor.basicAuth cannot be combined with rbacProxy.enabled: kube-rbac-proxy authenticates scrapes with the Prometheus ServiceAccount bearer token, and a monitor endpoint must define a single authentication method" }}
{{- end }}
{{- with .Values.prometheusPodMonitor.basicAuth }}
basicAuth:
{{- . | toYaml | nindent 6 }}
chart/templates/servicemonitor.yaml
+3
View File
@@ -25,6 +25,9 @@ spec:
bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
{{- end }}
scheme: {{ .Values.prometheusServiceMonitor.scheme }}
{{- if and .Values.rbacProxy.enabled .Values.prometheusServiceMonitor.basicAuth }}
{{- fail "prometheusServiceMonitor.basicAuth cannot be combined with rbacProxy.enabled: kube-rbac-proxy authenticates scrapes with the Prometheus ServiceAccount bearer token, and a monitor endpoint must define a single authentication method" }}
{{- end }}
{{- with .Values.prometheusServiceMonitor.basicAuth }}
basicAuth:
{{- . | toYaml | nindent 6 }}
chart/values.yaml
+2 -2
View File
@@ -826,7 +826,7 @@ prometheusServiceMonitor:
# type: object
# additionalProperties: true
# @schema
# -- BasicAuth credentials for the ServiceMonitor endpoint (Secret key selectors for `username` and `password`), see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.BasicAuth
# -- BasicAuth credentials for the ServiceMonitor endpoint (Secret key selectors for `username` and `password`). Mutually exclusive with `rbacProxy.enabled`, which authenticates scrapes with the Prometheus ServiceAccount bearer token — the chart refuses to render both. See: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.BasicAuth
basicAuth: {}
# @schema
# type: object
@@ -873,7 +873,7 @@ prometheusPodMonitor:
# type: object
# additionalProperties: true
# @schema
# -- BasicAuth credentials for the PodMonitor endpoint (Secret key selectors for `username` and `password`), see: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.BasicAuth
# -- BasicAuth credentials for the PodMonitor endpoint (Secret key selectors for `username` and `password`). Mutually exclusive with `rbacProxy.enabled`, which authenticates scrapes with the Prometheus ServiceAccount bearer token — the chart refuses to render both. See: https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.BasicAuth
basicAuth: {}
# @schema
# type: object