add node-exporter to allowed ports #6944
Conversation
k8s-ci-robot
added
cncf-cla: yes
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: zetaab The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
approved
| PortRangeMax: i(9100), | ||
| } | ||
| // allow 9100 port from nodeSG | ||
| addDirectionalGroupRule(c, masterSG, nodeSG, nodeExporterIngress) |
There was a problem hiding this comment.
@drekle is this correct? so I want that 9100 port in master security group is open when connecting from nodeSG
There was a problem hiding this comment.
Yeah this is correctly interpreted. Perhaps you can find better wording for the function.
k8s-ci-robot
added
area/provider/openstack
| @@ -294,6 +294,26 @@ func (b *FirewallModelBuilder) addKubeletRules(c *fi.ModelBuilderContext, sgMap | |||
| return nil | |||
| } | |||
|
|
|||
| // addNodeExporterRules - Allow 9100 TCP port from nodesg | |||
There was a problem hiding this comment.
I don't believe that Kops can be responsible for deploying prometheus, or prometheus-operator. Kops cant be responsible for the security groups of applications it's not also responsible for managing.
I think we can use additionalSecurityGroups as defined in the instance group spec to enable this, though it seems more manual. Additionally we might provide a way to declare in the spec that you need additional security groups created.
There was a problem hiding this comment.
this same deployment (kube-prometheus) works fine in aws kops clusters. @chrisz100 @mikesplain do you have idea should we allow this or not? Should openstack behave in similar way than aws?
There was a problem hiding this comment.
I actually need this too. Still interested in thoughts from @chrisz100 and @mikesplain, however I think I will approve this for now and come up with any other solutions I feel might be more appropriate as needed.
We still have the flexibility of changing things as this is still labeled alpha.
/lgtm
k8s-ci-robot
added
the
lgtm
Cherry-pick #6944 to release-1.13
Cherry-pick #6944 to release-1.14
The problem what we currently have in openstack is that node-exporter does not work correctly. The default behaviour in kube-prometheus is that it will expose node-exporter using hostnetwork https://github.com/coreos/kube-prometheus/blob/master/manifests/node-exporter-daemonset.yaml#L68 this means that port 9100 should be open to prometheus itself (running in normal nodes).
After I opened 9100 port ingress in both master+node SG it works
/sig openstack
/kind feature