dns
dns copied to clipboard
kubernetes
Enable optional TLS on nodecache metrics endpoint
Fixes #692. Chose to do the configuration with flags instead of extra config file because thought that it will be simpler and more in line with the project overall.
Adapted the implementation for CoreDNS metrics TLS support to nodecache. The original PR here https://github.com/coredns/coredns/pull/7255
- TLS support optional (backward compatible)
- TLS can be configured through command line flags, including the key files and client certificate.
- Added tests
New command line flags
tls-cert-filedefault value/etc/ssl/tls.crttls-private-key-filedefault value/etc/ssl/tls.keyclient-auth-typedefault valueNoClientCertclient-ca-filedefault value emptytls-min-versiondefault value TLS version 13tls-enableddefault value false
In order to use the feature, one needs to give as flag -tls-enabled=1. The defaults are used and the existence of TLS key-files is checked and error is thrown if no files are found. The defaults can be changed by using the corresponding flags.
Welcome @nuhakala!
It looks like this is your first PR to kubernetes/dns 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.
You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.
You can also check if kubernetes/dns has its own contribution guidelines.
You may want to refer to our testing guide if you run into trouble with your tests not passing.
If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!
Thank you, and welcome to Kubernetes. :smiley:
Hi @nuhakala. Thanks for your PR.
I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.
Once the patch is verified, the new status will be reflected by the ok-to-test label.
I understand the commands that are listed here.
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.
[APPROVALNOTIFIER] This PR is NOT APPROVED
This pull-request has been approved by: nuhakala Once this PR has been reviewed and has the lgtm label, please assign damiansawicki for approval. For more information see the Code Review Process.
The full list of commands accepted by this bot can be found here.
Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment
Unknown CLA label state. Rechecking for CLA labels.
Send feedback to sig-contributor-experience at kubernetes/community.
/check-cla /easycla
The committers listed above are authorized under a signed CLA.
- :white_check_mark: login: nuhakala / name: Nuutti Hakala (c825d0bd319979d5e0953e182f9a0cdbf38cd6d5)
![linux-foundation-easycla[bot] avatar](https://avatars.githubusercontent.com/in/17893?v=4 "Published by a pub.dev verified publisher"){kind=small}
@bowei @MrHohn Can I get a review on this so that the PR can move forward?
it would be great to have some reviews on this one and move it forward. /cc @DamianSawicki
it would be great to have some reviews on this one and move it forward. /cc @DamianSawicki
Personally, I won't be able to have a look at it at the moment.
I see 3 open PRs touching the cmd/node-cache directory (this one, https://github.com/kubernetes/dns/pull/690, and https://github.com/kubernetes/dns/pull/689). It could be really beneficial if authors of these PRs, with apparent expertise in node-cache, could cross-review each other's PRs. CC: @Michcioperz @johnbelamaric @zooneon
This PR is self-contained and primarily focuses on updates to metrics.go and metrics_test.go. The changes to main.go and cache_app.go are minimal and only introduce optional flags to support TLS encryption for the /metrics endpoint.
The implementation is designed to be non-intrusive and does not alter existing functionality. As such, reviewing this PR does not require familiarity with other open pull requests.
@DamianSawicki can we get some reviews on this? This is a useful optional feature and shouldn't hamper the usual workflow if not used.
The meaningful changes the three files under cmd/node-cache/app directory. Rest of the changes are in the auto generated vendor directory and some test configs added for the metrics_test. @bowei , @MrHohn, @DamianSawicki PTAL and if you have any question I'm happy to help. This feature doesn't affect the current workflows in any way but allows more security for the users that need it.