Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prometheus tls path #3615

Merged
merged 8 commits into from
Mar 8, 2023
+13 −4
Merged

Prometheus tls path #3615

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
b3baf9f
Update path to store prometheus secrets
shaun-nx Mar 2, 2023
2c44c8c
Move DefaultSecretPath const to configurator and add nosec G101
shaun-nx Mar 2, 2023
24b68b8
Merge branch 'main' into prometheusTLSPath
shaun-nx Mar 2, 2023
9787985
Merge branch 'main' into prometheusTLSPath
shaun-nx Mar 7, 2023
0a937c3
Fix lint error
shaun-nx Mar 7, 2023
814b608
Update error check
shaun-nx Mar 7, 2023
6c067de
Update error message
shaun-nx Mar 8, 2023
0868508
Change function name
shaun-nx Mar 8, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions internal/configs/configurator.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,9 @@ const (
// DefaultServerSecretPath is the full path to the Secret with a TLS cert and a key for the default server. #nosec G101
const DefaultServerSecretPath = "/etc/nginx/secrets/default"

// DefaultSecretPath is the full default path to where secrets are stored and accessed.
const DefaultSecretPath = "/etc/nginx/secrets" // #nosec G101

// DefaultServerSecretName is the filename of the Secret with a TLS cert and a key for the default server.
const DefaultServerSecretName = "default"

Expand Down
14 changes: 10 additions & 4 deletions internal/metrics/listener.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ import (
"strconv"

"github.com/golang/glog"
config "github.com/nginxinc/kubernetes-ingress/internal/configs"
"github.com/nginxinc/kubernetes-ingress/internal/nginx"
prometheusClient "github.com/nginxinc/nginx-prometheus-exporter/client"
nginxCollector "github.com/nginxinc/nginx-prometheus-exporter/collector"
Expand Down Expand Up @@ -59,12 +60,12 @@ func runServer(port string, registry prometheus.Gatherer, prometheusSecret *api_
// Write the cert and key to a temporary file. We create a unique file name to prevent collisions.
certFileName := "nginx-prometheus.cert"
keyFileName := "nginx-prometheus.key"
certFile, err := writeTempFile(prometheusSecret.Data[api_v1.TLSCertKey], certFileName)
certFile, err := createTLSFile(prometheusSecret.Data[api_v1.TLSCertKey], certFileName)
if err != nil {
glog.Fatal("failed to create cert file for prometheus: %w", err)
}

keyFile, err := writeTempFile(prometheusSecret.Data[api_v1.TLSPrivateKeyKey], keyFileName)
keyFile, err := createTLSFile(prometheusSecret.Data[api_v1.TLSPrivateKeyKey], keyFileName)
if err != nil {
glog.Fatal("failed to create key file for prometheus: %w", err)
}
Expand All @@ -73,8 +74,13 @@ func runServer(port string, registry prometheus.Gatherer, prometheusSecret *api_
}
}

func writeTempFile(data []byte, name string) (*os.File, error) {
f, err := os.CreateTemp("", name)
func createTLSFile(data []byte, name string) (*os.File, error) {
_, err := os.Stat(config.DefaultSecretPath)
shaun-nx marked this conversation as resolved.
Show resolved Hide resolved
if err != nil {
return nil, fmt.Errorf("got error %w when attempting access %s", err, config.DefaultSecretPath)
}

f, err := os.CreateTemp(config.DefaultSecretPath, name)
if err != nil {
return nil, fmt.Errorf("failed to create temp file: %w", err)
}
Expand Down