Repository navigation
Allow file references in PodMonitorEndpointTLSConfig #3922
Description
What is missing?
PodMonitorEndpointTLSConfig doesn't allow to reference certificates and key files.
Why do we need it?
This is causing us some trouble with Istio. As explained in istio docs, sidecar proxy can't deal with scraping requests because they are destined for pod's IP, so in order to scrape metrics over TLS sidecar should be configured to save certs and key to a volume and job's TLS config should reference them. While it is possible to achieve with ServiceMonitor, it is not with PodMonitor. And unfortunately there is no obvious way to dump these certs and key to a secret/configmap.
-
Prometheus Operator version:
v0.43.2
Activity
simonpasquier commentedon Mar 19, 2021
It's on purpose that PodMonitors (as well as Probes) can't reference files that reside on the Prometheus pod's filesystem. It avoids exposing sensitive materials to the scraped targets inadvertently. ServiceMonitors support this because they predate PodMonitors and we can't change the API.
okhaliavka commentedon Mar 23, 2021
@simonpasquier Is it reasonable to assume that this functionality in ServiceMonitor will be deprecated in the future? Could it be added to PodMonitors with the flag to opt-out of this behavior (like
ArbitraryFSAccessThroughSMsConfig)?ThiruNandagopal commentedon Jun 23, 2021
It would be great if we have this feature in podmonitor also similar to servicemonitor as we don't need to follow 2 different approach for same feature.
mblaschke commentedon May 30, 2022
Would be nice to have this feature also for PodMonitor to support fetching metrics with Istio
EronWright commentedon May 11, 2023
I have a suggestion for a fix, feedback welcome. #4121 (comment)
Update: I submitted a formal proposal for this idea: #5572
abohne commentedon Aug 24, 2023
Any updates on this?
taisph commentedon Apr 23, 2024
Is this issue also why a tlsConfig with files in a scrape class is not applied to PodMonitors? The same scrape class works with ServiceMonitors.
simonpasquier commentedon Apr 29, 2024
ScrapeClass is the answer to the original issue.