unkin-agent
f268c4d9ba
ghp serves metrics over HTTPS (TLS configured globally), but the liveness/readiness probes used the default HTTP scheme, so the kubelet probe hit an HTTPS-server error and pods never went Ready. Set scheme: HTTPS on both probes (kubelet does not verify the probe cert). The VMServiceScrape targets that same HTTPS endpoint, so set scheme: https with tlsConfig.insecureSkipVerify (internal-CA cert, pod-IP target not in the cert SANs); otherwise VM scraping of ghp fails. - deployment.yaml: liveness+readiness probes scheme HTTP -> HTTPS - vmservicescrape.yaml: scheme https + tlsConfig.insecureSkipVerify
24 lines
698 B
YAML
24 lines
698 B
YAML
---
|
|
# Scrape ghp's Prometheus metrics endpoint. Picked up by the observability
|
|
# VMAgent (selectAllByDefault). Estate uses VictoriaMetrics, so VMServiceScrape
|
|
# rather than a prometheus-operator ServiceMonitor.
|
|
apiVersion: operator.victoriametrics.com/v1beta1
|
|
kind: VMServiceScrape
|
|
metadata:
|
|
name: ghp
|
|
namespace: ghp
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "2"
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app: ghp
|
|
endpoints:
|
|
- port: metrics
|
|
path: /metrics
|
|
scheme: https
|
|
# ghp serves metrics over TLS with an internal-CA cert; skip verification
|
|
# since the scrape targets a pod IP the cert SANs do not cover.
|
|
tlsConfig:
|
|
insecureSkipVerify: true
|