Open se0wtf opened 5 years ago
Hi,
I got exactly the same problem across the board of k8s integration.
Is there a solution to this?
Thanks, Woj
I get the same issue when integrate it with prometheus:
ad.datadoghq.com/openam.init_configs: [{}]
ad.datadoghq.com/openam.instances:
[
{
"prometheus_url": "https://user:pass@%%host%%:8443/json/metrics/prometheus",
"namespace": "openam",
"metrics": ["*"],
"tls_verify": false,
"tls_ignore_warning": true
}
]
When I tried to connect from datadog agent pod:
curl https://user:pass@10.8.117.251:8443/json/metrics/prometheus -vvv
* Trying 10.8.117.251:8443...
* TCP_NODELAY set
* Connected to 10.8.117.251 (10.8.117.251) port 8443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /opt/datadog-agent/embedded/ssl/certs/cacert.pem
CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Request CERT (13):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS alert, unknown CA (560):
* SSL certificate problem: self signed certificate in certificate chain
* Closing connection 0
curl: (60) SSL certificate problem: self signed certificate in certificate chain
More details here: https://curl.haxx.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
I've spent a few days debugging this issue and build the following configurations that work:
Helm configuration:
confd:
openmetrics.yaml: |
init_config:
instances:
- prometheus_url: "https://host:port/metrics"
metrics:
- "*"
bearer_token_auth: true
tls_verify: false
Pod annotations:
ad.datadoghq.com/CONTAINER_NAME.check_names: |
["openmetrics"]
ad.datadoghq.com/CONTAINER_NAME.init_configs: |
[{}]
ad.datadoghq.com/CONTAINER_NAME.instances: |
[
{
"prometheus_url": "https://%%host%%:%%port%%/metrics",
"namespace": "YOUR_NAMESPACE",
"metrics": [
"*"
],
"bearer_token_auth": true,
"tls_verify": false
}
]
Hello, I'm testing datadog on a kubernetes cluster. -> no problem to fetch ES/Kafka metrics.
The kubelet api respond to
https://192.168.110.50:6443
but the certificate is not valid.Example with curl (from inside the datadog pod) :
I need the
k
option to pass the SSL checkThis is my configuration for
kubelet.d/conf.yaml
And this is the result from
agent status
:This is my configuration for
kubernetes_state.d/conf.yaml
:And this is the result from
agent status
:So what do i need to do to skip the SSL verification for the metrics ? Thanks guys ;)