[kube-state-metrics] If kubeRBACProxy is enabled do not enable Probes #6110
Conversation
yellowhat
force-pushed
the
main
branch
2 times, most recently
from
7a132ae to
5d315a0
Compare
|
@yellowhat thanks for the PR. We also run into this issue. |
|
But probes are a useful mechanism for application health |
|
Before the change of the port name, it was using the port number from another container, so it is the same |
|
but it was working and before the change there where no ports definition for the kube-state-metrics container |
|
Exactly because it was using the port number from the other container |
|
maybe we should focus on the native auth-filter #5858 (comment) and remove the kube-rbac-proxy containers |
|
If someone wants to take look do it, I just need a solution now. |
|
rollback to a previous release and set the image tag to 2.17.0 is not an option? |
|
But now whoever uses kube-state-metrics with I would suggest to roll forward. |
|
but unfortunately i can't help you here. Someone from the reviewers need to merge this |
Signed-off-by: yellowhat <[email protected]>
Signed-off-by: yellowhat <[email protected]>
2 participants
What this PR does / why we need it
The MR broke the deployment with
kubeRBACProxy.enabled=true, as*Probes:reference a
portname that it is not defined for that container.As alternative we could define:
- name: kube-state-metrics args: - --host=127.0.0.1 - --port=9090 - --resources=certificatesigningrequests,cronjobs,daemonsets,deployments,endpoints,horizontalpodautoscalers,ingresses,jobs,leases,limitranges,mutatingwebhookconfigurations,namespaces,networkpolicies,nodes,persistentvolumeclaims,persistentvolumes,poddisruptionbudgets,pods,replicasets,replicationcontrollers,resourcequotas,services,statefulsets,storageclasses,validatingwebhookconfigurations,volumeattachments - --metric-labels-allowlist=pods=[app,component,environment],deployments=[app,component,environment],daemonsets=[app,component,environment],jobs=[app,component,environment],services=[app,component,environment],statefulsets=[app,component,environment] - --metric-annotations-allowlist=pods=[alfaview.com/projectPath],deployments=[alfaview.com/projectPath],daemonsets=[alfaview.com/projectPath],jobs=[alfaview.com/projectPath],services=[alfaview.com/projectPath],statefulsets=[alfaview.com/projectPath] - --telemetry-host=127.0.0.1 - --telemetry-port=9091 imagePullPolicy: IfNotPresent image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.0 + ports: + - containerPort: 8080 + name: http + - containerPort: 8081 + name: metricseven if
kubeRBACProxy.enabled=truebut we would point to the ports of another container.I would not do that:
Due to warning of duplicated port:
We are checking the same port 2 times (generating more request [I know they are small]) without getting anything
Confusing when reading the manifest (reference the port of another container?)
Which issue this PR fixes
(optional, in
fixes #<issue number>(, fixes #<issue_number>, ...)format, will close that issue when PR gets merged)kubeRBACProxy.enabled=trueSpecial notes for your reviewer
Checklist
[prometheus-couchdb-exporter])