Add Support for LDAPS

[dtseiler]

Need to query TLS certificate for LDAP servers with LDAPS (typically on port 636). Similar to what is done for PostreSQL, so that we can check and alert when certificate expiration is looming.

[chennin]

This is already supported via the TCP probe - mine is certainly working that way. LDAPS/636 is not typically STARTTLS, so that's why TCP just works. What problem are you having with the TCP probe and your LDAP server?

[dtseiler]

Very interesting, would be interested to learn how yours is set up.

The problem basically is that we don't see any result whatsoever from that probe, nor any type of log message of any sort to indicate what the problem may be. We are running a 3-pod openldap cluster in kubernetes, the service is listening on 636 for ldaps:

➜ kgpo --context dev -n foo -l app=openldap
NAME         READY   STATUS    RESTARTS   AGE
openldap-0   1/1     Running   0          8h
openldap-1   1/1     Running   0          10h
openldap-2   1/1     Running   0          10h

➜ kgsvc --context dev -n foo openldap
NAME       TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)           AGE
openldap   ClusterIP   10.xx.xx.xxx   <none>        389/TCP,636/TCP   1y11d

Here is how I've tried to set things up:

1. in my ssl-exporter deployment, I add a probe like this with the tcp module:

apiVersion: monitoring.coreos.com/v1
kind: Probe
metadata:
  name: ldap-ssl-exporter
spec:
  module: tcp
  targets:
    staticConfig:
      static: []
  prober:
    url: ssl-exporter:9219

which we then patch in an overlay to look for our LDAP cluster like so:

  - patch: |-
      - op: replace
        path: /spec/targets/staticConfig/static
        value:
          - openldap.foo.svc.cluster.local:636
    target:
      kind: Probe
      name: ldap-ssl-exporter

Once deployed, I can see the ldap-ssl-exporter probe in place just fine with the openldap.foo.svc.cluster.local:636 target.

However when I bring up the ssl probe metrics in prometheus, this one is nowhere to be found. If we try to curl the /probe endpoint for this specific target with the tcp_connect module, we see probe_success 0 Nevermind that last sentence, we do see probe_success 1 but no metrics values TLS info