vsphere-csi-driver icon indicating copy to clipboard operation
vsphere-csi-driver copied to clipboard

Published 20 hours ago • verified publisher icon kubernetes-sigs

Configurable metrics ports

Open jsafrane opened this issue 3 years ago • 16 comments

Is this a BUG REPORT or FEATURE REQUEST?: /kind feature

What happened: Currently, the CSI driver + syncer processes open metrics port at 0.0.0.0:2112 and 0.0.0.0:2113. This should be configurable on cmdline, both the listening address and port.

jsafrane avatar Apr 21 '22 16:04 jsafrane

cc: @lipingxue @SandeepPissay @gohilankit

divyenpatel avatar Apr 22 '22 00:04 divyenpatel

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue or PR as fresh with /remove-lifecycle stale
  • Mark this issue or PR as rotten with /lifecycle rotten
  • Close this issue or PR with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot avatar Jul 21 '22 01:07 k8s-triage-robot

/remove-lifecycle stale

jsafrane avatar Jul 21 '22 16:07 jsafrane

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue or PR as fresh with /remove-lifecycle stale
  • Mark this issue or PR as rotten with /lifecycle rotten
  • Close this issue or PR with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot avatar Oct 19 '22 16:10 k8s-triage-robot

/remove-lifecycle stale

jsafrane avatar Oct 24 '22 11:10 jsafrane

We ship CSI driver as static deployment yaml. For instance - https://github.com/kubernetes-sigs/vsphere-csi-driver/blob/v2.7.0/manifests/vanilla/vsphere-csi-driver.yaml

What change do you want in this?

gohilankit avatar Nov 03 '22 21:11 gohilankit

Because I don't want a random unprotected HTTP port open on 0.0.0.0. I want to have it on 127.0.0.1 and have kube-rbac-proxy to provide HTTPS with authentication + authorization on a public port instead.

jsafrane avatar Nov 04 '22 16:11 jsafrane

/assign @lipingxue

lipingxue avatar Nov 17 '22 22:11 lipingxue

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue as fresh with /remove-lifecycle stale
  • Close this issue with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot avatar Feb 15 '23 23:02 k8s-triage-robot

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue as fresh with /remove-lifecycle rotten
  • Close this issue with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

k8s-triage-robot avatar Mar 17 '23 23:03 k8s-triage-robot

/remove-lifecycle rotten

jsafrane avatar Mar 22 '23 16:03 jsafrane

Because I don't want a random unprotected HTTP port open on 0.0.0.0. I want to have it on 127.0.0.1 and have kube-rbac-proxy to provide HTTPS with authentication + authorization on a public port instead.

@jsafrane

  1. As @gohilankit mentioned, we ship CSI driver as static deployment yaml. For instance - https://github.com/kubernetes-sigs/vsphere-csi-driver/blob/v2.7.0/manifests/vanilla/vsphere-csi-driver.yaml In this example, "vsphere-csi-driver" is deployed as a K8s service with default type "ClusterIP" . You can expose it as "LoadBalancer" service with small tweak on the YAML file. Could you explain why this does not work for you? Any security issue/concerns you have with this model?
  2. What are the changes you expect us to make? Could you give more details on this?

lipingxue avatar Apr 07 '23 21:04 lipingxue

I want a new cmdline option, e.g. --metrics-address=127.0.0.1:8001, so I can set the interface + port where the driver exposes a port for metrics.

Right now, the driver is deployed with hostNetwork: true and at the same time it opens metrics port on 0.0.0.0, which means that it's exposed directly on the node. I.e. anyone in the cluster can read the driver metrics and, if lucky enough, can expose any CVE in go prometheus / http / networking stack.

jsafrane avatar Apr 12 '23 11:04 jsafrane

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue as fresh with /remove-lifecycle stale
  • Close this issue with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot avatar Jul 11 '23 11:07 k8s-triage-robot

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue as fresh with /remove-lifecycle rotten
  • Close this issue with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

k8s-triage-robot avatar Jan 19 '24 17:01 k8s-triage-robot

/remove-lifecycle rotten

jsafrane avatar Jan 30 '24 13:01 jsafrane

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue as fresh with /remove-lifecycle stale
  • Close this issue with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot avatar Apr 29 '24 14:04 k8s-triage-robot