enix / x509-certificate-exporter

A Prometheus exporter to monitor x509 certificates expiration in Kubernetes clusters or standalone
MIT License
626 stars 61 forks source link

"watchDirectories" all directories must exist? #94

Open love-miao opened 1 year ago

love-miao commented 1 year ago

The directories in the “watchDirectories” must be real. Can they be regular?

love-miao commented 1 year ago

if drectory is no exist, the error: MountVolume.SetUp failed for volume "dir-54c04198cac10209fa2e3dcebf5989eb6130595b" : hostPath type check failed: /data/apps/rancher/k3s/agent is not a directory

love-miao commented 1 year ago

My cluster node's home directory may be different

npdgm commented 1 year ago

Hi,

Yes, watchDirectories elements are converted to hostPath volumes in a DaemonSet. So all paths must exist on targeted nodes or some Pods wont be created. This behavior is enforced by Kubernetes. We cannot make a change to ignore paths not present on a node. Actually, this feature is quite useful to detect misconfigurations and regressions.

To deal with nodes not having homogeneous certificates paths, you will have to:

:arrow_right: You could have a look at our chart README with instructions on how to do that for kubeadm clusters.

if drectory is no exist, the error: MountVolume.SetUp failed for volume "dir-54c04198cac10209fa2e3dcebf5989eb6130595b" : hostPath type check failed: /data/apps/rancher/k3s/agent is not a directory

If your issue is that k3s server and k3s agent nodes are different, then the kubeadm example would be close to what you need.

If you also want different watchDirectories on different k3s agent, then it is necessary to add more labels. Either use kubectl label node ... or start k3s agents with an argument like : --node-label node-role.kubernetes.io/worker=worker