node-exporter listens on all addresses

[NicolasT]

Similar to #2165, the Prometheus node-exporter listens on the workload-plane address of a node. It should only bind to the control-plane address.

[alexandre-allard]

Not sure how we can achieve this as the node exporter is a daemonset, so we can't enforce the control plane IP.
We could set hostNetwork: false to not listen on each and every interfaces but in that case we end up with metrics having the Pod IP.

[NicolasT]

Hmh, good point about the DaemonSet... We can pass the -web.listen-address option to node_exporter to make it listen to a single address only, but this likely won't accept a CIDR or something alike. So I guess only thing we can do is have an entrypoint for the container that, given the control-plane CIDR, calculates the host address to use, then exec node_exporter with the -web.listen-address set to said IP (and the desired port).

[TeddyAndrieux]

With nowadays node-exporter helm chart it seems possible by just setting listenOnAllInterfaces to false

apiVersion: apps/v1
kind: DaemonSet
[...]
spec:
  [...]
  template:
    [...]
    spec:
      [...]
      containers:
         [...]
            - --web.listen-address=$(HOST_IP):{{ .Values.service.port }}
         [...]
          env:
          - name: HOST_IP
            {{- if .Values.service.listenOnAllInterfaces }}
            value: 0.0.0.0
            {{- else }}
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: status.hostIP
            {{- end }}

And since in kubelet config we enforce node-ip to control plane IP, it should be ok

[gdemonet]

We should do the same with kube-proxy

[TeddyAndrieux]

kube-proxy is not possible/easy to do today cf kubernetes/kubernetes#108737