search

ribbybibby / ssl_exporter

Exports Prometheus metrics for TLS certificates
Apache License 2.0
525 stars 99 forks source link

Support getting certificate information from a kubeconfig file #61

Closed treydock closed 3 years ago

treydock commented 3 years ago

The idea is to query the user certificate inside /etc/kubernetes/admin.conf. Example output queried on my dev Kubernetes cluster:

$  curl "http://kubecontroller-dev:9219/probe?module=kubeconfig&target=/etc/kubernetes/admin.conf"
# HELP ssl_kubeconfig_cert_not_after NotAfter expressed as a Unix Epoch Time for a certificate found in a kubeconfig
# TYPE ssl_kubeconfig_cert_not_after gauge
ssl_kubeconfig_cert_not_after{cn="kubernetes",dnsnames="",emails="",ips="",issuer_cn="kubernetes",kubeconfig="/etc/kubernetes/admin.conf",name="kubernetes",ou="",serial_no="335833545820969761192653058045228355723340563282",type="cluster"} 1.73817534e+09
ssl_kubeconfig_cert_not_after{cn="kubernetes-admin",dnsnames="",emails="",ips="",issuer_cn="kubernetes",kubeconfig="/etc/kubernetes/admin.conf",name="kubernetes-admin",ou="",serial_no="3629461269801086488",type="user"} 1.63743128e+09
# HELP ssl_kubeconfig_cert_not_before NotBefore expressed as a Unix Epoch Time for a certificate found in a kubeconfig
# TYPE ssl_kubeconfig_cert_not_before gauge
ssl_kubeconfig_cert_not_before{cn="kubernetes",dnsnames="",emails="",ips="",issuer_cn="kubernetes",kubeconfig="/etc/kubernetes/admin.conf",name="kubernetes",ou="",serial_no="335833545820969761192653058045228355723340563282",type="cluster"} 1.58049534e+09
ssl_kubeconfig_cert_not_before{cn="kubernetes-admin",dnsnames="",emails="",ips="",issuer_cn="kubernetes",kubeconfig="/etc/kubernetes/admin.conf",name="kubernetes-admin",ou="",serial_no="3629461269801086488",type="user"} 1.58049534e+09
# HELP ssl_probe_success If the probe was a success
# TYPE ssl_probe_success gauge
ssl_probe_success 1
# HELP ssl_prober The prober used by the exporter to connect to the target
# TYPE ssl_prober gauge
ssl_prober{prober="kubeconfig"} 1

Also works to read kubelet configs and their associated certificates:

$  curl "http://kubeworker01-dev:9219/probe?module=kubeconfig&target=/etc/kubernetes/kubelet.conf"
# HELP ssl_kubeconfig_cert_not_after NotAfter expressed as a Unix Epoch Time for a certificate found in a kubeconfig
# TYPE ssl_kubeconfig_cert_not_after gauge
ssl_kubeconfig_cert_not_after{cn="kubernetes",dnsnames="",emails="",ips="",issuer_cn="kubernetes",kubeconfig="/etc/kubernetes/kubelet.conf",name="default-cluster",ou="",serial_no="335833545820969761192653058045228355723340563282",type="cluster"} 1.73817534e+09
ssl_kubeconfig_cert_not_after{cn="system:node:kubeworker01-dev",dnsnames="",emails="",ips="",issuer_cn="kubernetes",kubeconfig="/etc/kubernetes/kubelet.conf",name="default-auth",ou="",serial_no="158874210270431228542581699797837542620",type="user"} 1.637427849e+09
# HELP ssl_kubeconfig_cert_not_before NotBefore expressed as a Unix Epoch Time for a certificate found in a kubeconfig
# TYPE ssl_kubeconfig_cert_not_before gauge
ssl_kubeconfig_cert_not_before{cn="kubernetes",dnsnames="",emails="",ips="",issuer_cn="kubernetes",kubeconfig="/etc/kubernetes/kubelet.conf",name="default-cluster",ou="",serial_no="335833545820969761192653058045228355723340563282",type="cluster"} 1.58049534e+09
ssl_kubeconfig_cert_not_before{cn="system:node:kubeworker01-dev",dnsnames="",emails="",ips="",issuer_cn="kubernetes",kubeconfig="/etc/kubernetes/kubelet.conf",name="default-auth",ou="",serial_no="158874210270431228542581699797837542620",type="user"} 1.605891849e+09
# HELP ssl_probe_success If the probe was a success
# TYPE ssl_probe_success gauge
ssl_probe_success 1
# HELP ssl_prober The prober used by the exporter to connect to the target
# TYPE ssl_prober gauge
ssl_prober{prober="kubeconfig"} 1
ribbybibby commented 3 years ago

Hi @treydock, thank you for this PR. It looks really good, however it doesn't seem to support paths relative to the kubeconfig file:

ERRO[0048] error=open certs/example/ca.pem: no such file or directory target=/Users/ribbybibby/.kube/config prober=kubeconfig timeout=10s  source="ssl_exporter.go:93"

Cluster config looks like this and is valid:

clusters:
  - cluster:
      certificate-authority: certs/example/ca.pem
      server: https://master.example.com
    name: example
treydock commented 3 years ago

@ribbybibby I added a commit that should fix the issue where a relative path is used. Let me know if the changes work for you. It assumes if the path is /home/user/.kube/config then your example would be /home/user/.kube/certs/example/ca.pem

treydock commented 3 years ago

@ribbybibby Would it be possible to get a tag/release that includes this pull request?

ribbybibby commented 3 years ago

@treydock Yep: https://github.com/ribbybibby/ssl_exporter/releases/tag/v2.2.1