Is this a bug report or feature request?
What should the feature do:
Currently the managed Prometheus that is part of the new monitoring stack doesn't force mTLS certificate verification.
|
# clientAuthType: "RequireAndVerifyClientCert" |
|
# TODO: we need the prometheus-operator not to require certs only for /-/readyz or to do exec probes that can read certs |
This was done temporarily on purpose because the prometheus-operator sets up probes behind authenticated enpoints, which obviously doesn't work because kubelets don't have the client certs for mTLS. We need to start by creating a simple reproducer and report it to the prometheus-operator.
What is use case behind this feature:
Security
fyi @YvanDaSilva (so you are not surprised when this gets fixed)
# Requires
- [ ] https://github.com/prometheus/prometheus/issues/9166
- [ ] https://github.com/scylladb/scylla-operator/issues/2187
- [ ] https://github.com/prometheus-operator/prometheus-operator/issues/5419
Is this a bug report or feature request?
What should the feature do:
Currently the managed Prometheus that is part of the new monitoring stack doesn't force mTLS certificate verification.
scylla-operator/assets/monitoring/prometheus/v1/prometheus.yaml
Lines 21 to 22 in f20887d
This was done temporarily on purpose because the prometheus-operator sets up probes behind authenticated enpoints, which obviously doesn't work because kubelets don't have the client certs for mTLS. We need to start by creating a simple reproducer and report it to the prometheus-operator.
What is use case behind this feature:
Security
fyi @YvanDaSilva (so you are not surprised when this gets fixed)