ghp serves metrics over HTTPS (TLS configured globally), but the
liveness/readiness probes used the default HTTP scheme, so the kubelet
probe hit an HTTPS-server error and pods never went Ready. Set
scheme: HTTPS on both probes (kubelet does not verify the probe cert).
The VMServiceScrape targets that same HTTPS endpoint, so set scheme:
https with tlsConfig.insecureSkipVerify (internal-CA cert, pod-IP target
not in the cert SANs); otherwise VM scraping of ghp fails.
- deployment.yaml: liveness+readiness probes scheme HTTP -> HTTPS
- vmservicescrape.yaml: scheme https + tlsConfig.insecureSkipVerify
unkin-agent
f268c4d9ba