cert-manager icon indicating copy to clipboard operation
cert-manager copied to clipboard

Helm chart: add ability to add appprotocol to port in service

Open KipsasJaujoj opened this issue 7 months ago • 0 comments

Is your feature request related to a problem? Please describe. When setting up prometheus to scrape metrics using Istio mTLS (guide here: https://istio.io/latest/docs/ops/integrations/prometheus/#tls-settings) cert-manager scraping breaks due to it using tcp-prometheus-servicemonitor as a port name and suggesting istio tcp` protocol should be used for connection. This can be fixed either:

  • changing service's port name to http-prometheus-servicemonitor
  • adding appProtocol: http attribute to service's port

Describe the solution you'd like For me, any of the options will work since they both solve the issue in the same manner. Although, it's worth mentioning that appProtocol was introduced in kubernetes version 1.20 so not everyone will be able to use the solution. Maybe using the latter option (appProtocol) is a bit more clear on intent as ability to change port name via helm values might be a bit ambiguous feature.

Describe alternatives you've considered Alternatives are:

  • not use Istio
  • not use mTLS for scraping Not viable options for me, I'll have to fork the helm chart and add the feature myself

Additional context Following prometheus issue helped me find the solution: https://github.com/prometheus/prometheus/issues/10213#issuecomment-1064280828 More info on auto protocol selection: https://istio.io/latest/docs/ops/configuration/traffic-management/protocol-selection/#explicit-protocol-selection

Environment details (remove if not applicable):

  • Install method: helm

/kind feature

KipsasJaujoj avatar Jul 18 '24 11:07 KipsasJaujoj