Add insecureSkipVerify option for Prometheus and Graphite

cmd/flagger/main.go

@@ -59,6 +59,7 @@ var (
 	kubeconfigQPS            int
 	kubeconfigBurst          int
 	metricsServer            string
+	insecureSkipVerify       bool
 	controlLoopInterval      time.Duration
 	logLevel                 string
 	port                     string
@@ -91,6 +92,7 @@ func init() {
 	flag.IntVar(&kubeconfigBurst, "kubeconfig-burst", 250, "Set Burst for kubeconfig.")
 	flag.StringVar(&masterURL, "master", "", "The address of the Kubernetes API server. Overrides any value in kubeconfig. Only required if out-of-cluster.")
 	flag.StringVar(&metricsServer, "metrics-server", "http://prometheus:9090", "Prometheus URL.")
+	flag.BoolVar(&insecureSkipVerify, "insecure-skip-verify", false, "disable verification of certificate for metrics server, this is insecure")
 	flag.DurationVar(&controlLoopInterval, "control-loop-interval", 10*time.Second, "Kubernetes API sync interval.")
 	flag.StringVar(&logLevel, "log-level", "debug", "Log level can be: debug, info, warning, error.")
 	flag.StringVar(&port, "port", "8080", "Port to listen on.")
@@ -190,7 +192,7 @@ func main() {
 		logger.Infof("Watching namespace %s", namespace)
 	}
 
-	observerFactory, err := observers.NewFactory(metricsServer)
+	observerFactory, err := observers.NewFactory(metricsServer, insecureSkipVerify)
 	if err != nil {
 		logger.Fatalf("Error building prometheus client: %s", err.Error())
 	}

pkg/apis/flagger/v1beta1/canary.go

@@ -66,6 +66,10 @@ type CanarySpec struct {
 	// +optional
 	MetricsServer string `json:"metricsServer,omitempty"`
 
+	// InsecureSkipVerify disables certificate verification for the provider
+	// +optional
+	InsecureSkipVerify bool `json:"insecureSkipVerify,omitempty"`
+
 	// TargetRef references a target resource
 	TargetRef CrossNamespaceObjectReference `json:"targetRef"`
 

pkg/apis/flagger/v1beta1/metric.go

@@ -74,6 +74,10 @@ type MetricTemplateProvider struct {
 	// Region of the provider
 	// +optional
 	Region string `json:"region,omitempty"`
+
+	// InsecureSkipVerify disables certificate verification for the provider
+	// +optional
+	InsecureSkipVerify bool `json:"insecureSkipVerify,omitempty"`
 }
 
 // MetricTemplateModel is the query template model

pkg/controller/scheduler_daemonset_fixture_test.go

@@ -95,7 +95,7 @@ func newDaemonSetFixture(c *flaggerv1.Canary) daemonSetFixture {
 	rf := router.NewFactory(nil, kubeClient, flaggerClient, "annotationsPrefix", "", logger, flaggerClient)
 
 	// init observer
-	observerFactory, _ := observers.NewFactory(testMetricsServerURL)
+	observerFactory, _ := observers.NewFactory(testMetricsServerURL, false)
 
 	// init canary factory
 	configTracker := &canary.ConfigTracker{

pkg/controller/scheduler_deployment_fixture_test.go

@@ -123,7 +123,7 @@ func newDeploymentFixture(c *flaggerv1.Canary) fixture {
 	rf := router.NewFactory(nil, kubeClient, flaggerClient, "annotationsPrefix", "", logger, flaggerClient)
 
 	// init observer
-	observerFactory, _ := observers.NewFactory(testMetricsServerURL)
+	observerFactory, _ := observers.NewFactory(testMetricsServerURL, false)
 
 	// init canary factory
 	configTracker := &canary.ConfigTracker{

pkg/controller/scheduler_metrics.go

@@ -41,7 +41,7 @@ func (c *Controller) checkMetricProviderAvailability(canary *flaggerv1.Canary) e
 			observerFactory := c.observerFactory
 			if canary.Spec.MetricsServer != "" {
 				var err error
-				observerFactory, err = observers.NewFactory(canary.Spec.MetricsServer)
+				observerFactory, err = observers.NewFactory(canary.Spec.MetricsServer, canary.Spec.InsecureSkipVerify)
 				if err != nil {
 					return fmt.Errorf("error building Prometheus client for %s %v", canary.Spec.MetricsServer, err)
 				}
@@ -120,7 +120,7 @@ func (c *Controller) runBuiltinMetricChecks(canary *flaggerv1.Canary) bool {
 	// override the global metrics server if one is specified in the canary spec
 	if canary.Spec.MetricsServer != "" {
 		var err error
-		observerFactory, err = observers.NewFactory(canary.Spec.MetricsServer)
+		observerFactory, err = observers.NewFactory(canary.Spec.MetricsServer, canary.Spec.InsecureSkipVerify)
 		if err != nil {
 			c.recordEventErrorf(canary, "Error building Prometheus client for %s %v", canary.Spec.MetricsServer, err)
 			return false

pkg/controller/scheduler_metrics_test.go

@@ -32,13 +32,13 @@ func TestController_checkMetricProviderAvailability(t *testing.T) {
 		// ok
 		analysis := &flaggerv1.CanaryAnalysis{Metrics: []flaggerv1.CanaryMetric{{Name: "request-success-rate"}}}
 		canary := &flaggerv1.Canary{Spec: flaggerv1.CanarySpec{Analysis: analysis}}
-		obs, err := observers.NewFactory(testMetricsServerURL)
+		obs, err := observers.NewFactory(testMetricsServerURL, false)
 		require.NoError(t, err)
 		ctrl := Controller{observerFactory: obs, logger: zap.S(), eventRecorder: &record.FakeRecorder{}}
 		require.NoError(t, ctrl.checkMetricProviderAvailability(canary))
 
 		// error
-		ctrl.observerFactory, err = observers.NewFactory("http://non-exist")
+		ctrl.observerFactory, err = observers.NewFactory("http://non-exist", false)
 		require.NoError(t, err)
 		require.Error(t, ctrl.checkMetricProviderAvailability(canary))
 

pkg/metrics/observers/factory.go

@@ -27,11 +27,12 @@ type Factory struct {
 	Client providers.Interface
 }
 
-func NewFactory(metricsServer string) (*Factory, error) {
+func NewFactory(metricsServer string, insecureSkipVerify bool) (*Factory, error) {
 	client, err := providers.NewPrometheusProvider(flaggerv1.MetricTemplateProvider{
-		Type:      "prometheus",
-		Address:   metricsServer,
-		SecretRef: nil,
+		Type:               "prometheus",
+		Address:            metricsServer,
+		SecretRef:          nil,
+		InsecureSkipVerify: insecureSkipVerify,
 	}, nil)
 	if err != nil {
 		return nil, err

pkg/metrics/providers/graphite.go

@@ -18,6 +18,7 @@ package providers
 
 import (
 	"context"
+	"crypto/tls"
 	"encoding/json"
 	"fmt"
 	"io/ioutil"
@@ -104,6 +105,7 @@ type GraphiteProvider struct {
 	username string
 	password string
 	timeout  time.Duration
+	client   *http.Client
 }
 
 // NewGraphiteProvider takes a provider spec and credentials map,
@@ -119,6 +121,13 @@ func NewGraphiteProvider(provider flaggerv1.MetricTemplateProvider, credentials
 	graph := GraphiteProvider{
 		url:     *graphiteURL,
 		timeout: 5 * time.Second,
+		client:  http.DefaultClient,
+	}
+
+	if provider.InsecureSkipVerify {
+		t := http.DefaultTransport.(*http.Transport).Clone()
+		t.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
+		graph.client = &http.Client{Transport: t}
 	}
 
 	if provider.SecretRef == nil {
@@ -168,7 +177,7 @@ func (g *GraphiteProvider) RunQuery(query string) (float64, error) {
 	ctx, cancel := context.WithTimeout(req.Context(), g.timeout)
 	defer cancel()
 
-	r, err := http.DefaultClient.Do(req.WithContext(ctx))
+	r, err := g.client.Do(req.WithContext(ctx))
 	if err != nil {
 		return 0, fmt.Errorf("request failed: %w", err)
 	}

pkg/metrics/providers/prometheus.go

@@ -18,6 +18,7 @@ package providers
 
 import (
 	"context"
+	"crypto/tls"
 	"encoding/json"
 	"fmt"
 	"io/ioutil"
@@ -39,6 +40,7 @@ type PrometheusProvider struct {
 	url      url.URL
 	username string
 	password string
+	client   *http.Client
 }
 
 type prometheusResponse struct {
@@ -64,6 +66,13 @@ func NewPrometheusProvider(provider flaggerv1.MetricTemplateProvider, credential
 	prom := PrometheusProvider{
 		timeout: 5 * time.Second,
 		url:     *promURL,
+		client:  http.DefaultClient,
+	}
+
+	if provider.InsecureSkipVerify {
+		t := http.DefaultTransport.(*http.Transport).Clone()
+		t.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
+		prom.client = &http.Client{Transport: t}
 	}
 
 	if provider.SecretRef != nil {
@@ -106,7 +115,7 @@ func (p *PrometheusProvider) RunQuery(query string) (float64, error) {
 	ctx, cancel := context.WithTimeout(req.Context(), p.timeout)
 	defer cancel()
 
-	r, err := http.DefaultClient.Do(req.WithContext(ctx))
+	r, err := p.client.Do(req.WithContext(ctx))
 	if err != nil {
 		return 0, fmt.Errorf("request failed: %w", err)
 	}