Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[receiver/kubeletstats] tls verify config not being respected #26319

Closed
jinja2 opened this issue Aug 30, 2023 · 7 comments
Closed

[receiver/kubeletstats] tls verify config not being respected #26319

jinja2 opened this issue Aug 30, 2023 · 7 comments
Assignees
Labels

Comments

@jinja2
Copy link
Contributor

jinja2 commented Aug 30, 2023

Component(s)

receiver/kubeletstats

What happened?

Description

The receiver exposes the config InsecureSkipVerify which let's user decide if the receiver should verify the server's certificate chain and hostname. The documentation implies that this config is respected for all modes of auth_type but it is not respected with the auth mode service_account where is it set to true always

Steps to Reproduce

Expected Result

insecure_skip_verify option should be honored when the auth mode with kubelet is service_account

Actual Result

insecure_skip_verify option is not used when the auth mode with kubelet is service_account

Collector version

latest

Environment information

Environment

OS: (e.g., "Ubuntu 20.04")
Compiler(if manually compiled): (e.g., "go 14.2")

OpenTelemetry Collector configuration

No response

Log output

No response

Additional context

No response

@jinja2 jinja2 added bug Something isn't working needs triage New item requiring triage labels Aug 30, 2023
@github-actions
Copy link
Contributor

Pinging code owners:

See Adding Labels via Comments if you do not have permissions to add labels yourself.

@crobert-1
Copy link
Member

This was originally introduced in #324. All examples in the original PR set insecure_skip_verify: true, but there aren't any comments on why. There is an example config used in testing that technically hits this case, but it just makes sure the config is valid, it doesn't check the end value.

The solution here is to either honor the insecure_skip_verify setting, or include reasoning in documentation for why it's always ignored.

@crobert-1
Copy link
Member

/label -needs-triage

@crobert-1
Copy link
Member

I checked with the original author and it sounds like this wasn't intentional, so the solution will be to honor the insecure_skip_verify setting.

@jinja2
Copy link
Contributor Author

jinja2 commented Sep 8, 2023

Thank you @crobert-1! You can assign this to me.

TylerHelmuth pushed a commit that referenced this issue Sep 14, 2023
**Description:** <Describe what has changed.>
<!--Ex. Fixing a bug - Describe the bug and how this fixes the issue.
Ex. Adding a feature - Explain what this achieves.-->

Adds an E2E test for kubeletstats receiver

Updates existing e2e k8s tests to bootstrap kind cluster with valid
kubelet certificates. This will make k8s clusters used in the e2e test
more inline with the security practices used by real clusters and
improve testing with the kubeletstats receiver which connects to kubelet
server.

**Link to tracking Issue:**
[26319](#26319)

**Testing:** <Describe what testing was performed and which tests were
added.>

**Documentation:** <Describe the documentation added.>
TylerHelmuth pushed a commit that referenced this issue Sep 27, 2023
…account auth (#27070)

**Description:** <Describe what has changed.>
<!--Ex. Fixing a bug - Describe the bug and how this fixes the issue.
Ex. Adding a feature - Explain what this achieves.-->
Fix to use the `insecure_skip_verify` config in http client when
connecting with kubelet in service account auth mode.


**Link to tracking Issue:**
[26319](#26319)

**Testing:** <Describe what testing was performed and which tests were
added.>
Unit tests added, e2e test updated
**Documentation:** <Describe the documentation added.>
Copy link
Contributor

github-actions bot commented Nov 8, 2023

This issue has been inactive for 60 days. It will be closed in 60 days if there is no activity. To ping code owners by adding a component label, see Adding Labels via Comments, or if you are unsure of which component this issue relates to, please ping @open-telemetry/collector-contrib-triagers. If this issue is still relevant, please ping the code owners or leave a comment explaining why it is still relevant. Otherwise, please close it.

Pinging code owners:

See Adding Labels via Comments if you do not have permissions to add labels yourself.

@github-actions github-actions bot added the Stale label Nov 8, 2023
@crobert-1
Copy link
Member

Fixed by #27070. Thanks @jinja2!

jmsnll pushed a commit to jmsnll/opentelemetry-collector-contrib that referenced this issue Nov 12, 2023
…account auth (open-telemetry#27070)

**Description:** <Describe what has changed.>
<!--Ex. Fixing a bug - Describe the bug and how this fixes the issue.
Ex. Adding a feature - Explain what this achieves.-->
Fix to use the `insecure_skip_verify` config in http client when
connecting with kubelet in service account auth mode.


**Link to tracking Issue:**
[26319](open-telemetry#26319)

**Testing:** <Describe what testing was performed and which tests were
added.>
Unit tests added, e2e test updated
**Documentation:** <Describe the documentation added.>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants