Resolve K8s API server IP using DNS (#330)

* Explicitly specify API server Service name so DNS resolves to IP matching cert. * Update changelog * add server_name to jsonnet Co-authored-by: Robert Fratto <robertfratto@gmail.com>
grafana · Jan 14, 2021 · b8e5f19 · b8e5f19
1 parent 4c6da96
commit b8e5f19
Show file tree

Hide file tree

Showing 4 changed files with 9 additions and 0 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,6 +4,9 @@ can be found at [#317](https://github.com/grafana/agent/issues/317).
 
 # Master (unreleased)
 
+- [BUGFIX] The K8s API server scrape job will use the API server Service name
+  when resolving IP addresses for Prometheus service discovery using the "Endpoints" role. (@hjet)
+
 # v0.10.0 (2021-01-13)
 
 - [FEATURE] Prometheus `remote_write` now supports SigV4 authentication using 

diff --git a/production/kubernetes/agent.yaml b/production/kubernetes/agent.yaml
@@ -198,6 +198,7 @@ data:
                 tls_config:
                     ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
                     insecure_skip_verify: false
+                    server_name: kubernetes
         global:
             scrape_interval: 15s
         wal_directory: /var/lib/agent/data
@@ -242,6 +243,7 @@ data:
                 tls_config:
                     ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
                     insecure_skip_verify: false
+                    server_name: kubernetes
         global:
             scrape_interval: 15s
         wal_directory: /var/lib/agent/data

diff --git a/production/tanka/grafana-agent/config.libsonnet b/production/tanka/grafana-agent/config.libsonnet
@@ -112,6 +112,7 @@
         tls_config: {
           ca_file: '/var/run/secrets/kubernetes.io/serviceaccount/ca.crt',
           insecure_skip_verify: $._config.prometheus_insecure_skip_verify,
+          server_name: 'kubernetes',
         },
         bearer_token_file: '/var/run/secrets/kubernetes.io/serviceaccount/token',
         relabel_configs: [{

diff --git a/production/tanka/grafana-agent/v1/internal/kubernetes_instance.libsonnet b/production/tanka/grafana-agent/v1/internal/kubernetes_instance.libsonnet
@@ -25,6 +25,9 @@ local k8s_tls_config(config) = {
           role: if config.scrape_api_server_endpoints then 'endpoints' else 'service',
         }],
         scheme: 'https',
+        tls_config+: {
+          server_name: 'kubernetes',
+        },
 
         relabel_configs: [{
           source_labels: ['__meta_kubernetes_service_label_component'],