Update the Kubernetes Proxy monitor for OpenShift clusters to stop us…

…ing insecure port 29101 and start using secure port 9101 with authentication (810)
signalfx · Jun 13, 2023 · 03e82f3 · 03e82f3
1 parent 6646f31
commit 03e82f3
Show file tree

Hide file tree

Showing 4 changed files with 15 additions and 4 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,6 +4,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ## Unreleased
 
+### Changed
+
+- Update the Kubernetes Proxy monitor for OpenShift clusters to stop using insecure port 29101 and start using secure port 9101 with authentication [#810](https://github.com/signalfx/splunk-otel-collector-chart/pull/810)
+
+### Changed
 ## [0.78.0] - 2023-06-07
 
 This Splunk OpenTelemetry Collector for Kubernetes release adopts the [Splunk OpenTelemetry Collector v0.78.1](https://github.com/signalfx/splunk-otel-collector/releases/tag/v0.78.1).

diff --git a/examples/distribution-openshift/rendered_manifests/configmap-agent.yaml b/examples/distribution-openshift/rendered_manifests/configmap-agent.yaml
@@ -214,8 +214,11 @@ data:
             config:
               extraDimensions:
                 metric_source: kubernetes-proxy
-              port: 29101
+              port: 9101
+              skipVerify: true
               type: kubernetes-proxy
+              useHTTPS: true
+              useServiceAccount: true
             rule: type == "pod" && labels["app"] == "sdn"
           smartagent/kubernetes-scheduler:
             config:

diff --git a/examples/distribution-openshift/rendered_manifests/daemonset.yaml b/examples/distribution-openshift/rendered_manifests/daemonset.yaml
@@ -29,7 +29,7 @@ spec:
         app: splunk-otel-collector
         release: default
       annotations:
-        checksum/config: 5015b9567107e9b822bc7f80d80f9a90ecc1e37288493008310feaf2c5077723
+        checksum/config: d7d81f2cb9d13b66936f052dcd335a1a72037a201b8cbef376b618231627caf2
         kubectl.kubernetes.io/default-container: otel-collector
     spec:
       hostNetwork: true

diff --git a/helm-charts/splunk-otel-collector/templates/config/_otel-agent.tpl b/helm-charts/splunk-otel-collector/templates/config/_otel-agent.tpl
@@ -91,7 +91,7 @@ receivers:
 
       # Receivers for collecting k8s control plane metrics.
       # Distributions besides Kubernetes and Openshift are not supported.
-      # Verified with Kubernetes v1.22 and Openshift v4.9.
+      # Verified with Kubernetes v1.22 and Openshift v4.10.59.
       {{- if or (eq .Values.distribution "openshift") (eq .Values.distribution "") }}
       # Below, the TLS certificate verification is often skipped because the k8s default certificate is self signed and
       # will fail the verification.
@@ -182,7 +182,10 @@ receivers:
             metric_source: kubernetes-proxy
           type: kubernetes-proxy
           {{- if eq .Values.distribution "openshift" }}
-          port: 29101
+          skipVerify: true
+          useHTTPS: true
+          useServiceAccount: true
+          port: 9101
           {{- else }}
           port: 10249
           {{- end }}