Use hostPath to watch all certificates in node (if running in daemonset mode)

[Dentrax]

We can use hostPath to bind the current node's /etc/kubernetes/ path to watch all certificates if running mode is DaemonSet.

• /etc/kubernetes/pki/*.crt
• /etc/kubernetes/ssl/*.crt

/etc/kubernetes/pki/apiserver.crt
/etc/kubernetes/pki/apiserver-etcd-client.crt
/etc/kubernetes/pki/apiserver-kubelet-client.crt
/etc/kubernetes/pki/ca.crt
/etc/kubernetes/pki/front-proxy-ca.crt
/etc/kubernetes/pki/front-proxy-client.crt
/etc/kubernetes/pki/etcd/ca.crt
/etc/kubernetes/pki/etcd/client.crt
/etc/kubernetes/pki/etcd/peer.crt
/etc/kubernetes/pki/etcd/server.crt

Wdyt?

[npdgm]

Hi @Dentrax

What you're looking for sounds like issue #48. Is that correct? The goal being to to enhance watchDirectories: [] with regexp support.

I can see that we work on the feature if the contribution is unlikely.

Cheers

[Dentrax]

Thanks for reference! It's exactly what was I looking for. But I still want to propose we can merge those both issues. We can watch aforementioned paths in the issue by default. Also, users can pass custom watchDirectories: [] additionally. Because /etc/kubernetes path is Kubernetes standard.

Security Concern

If cluster admin do not want to use hostPath due to security concerns, it's fine. We can create a custom feature flag such as watchKubernetesCertsOnHost to enable this feature if exporter deployed as DaemonSet. (Otherwise it would redundant since Deployment does not roll out pods to all nodes)

Wdyt?