prometheus / prometheus/exporter-toolkit
Dedicated webserver for health check endpoint
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 311
- Forks
- 109
- Avg merge
- 3d 59m
- Merged PRs (30d)
- 6
Description
Prometheus with direct TLS support (by using --web.config.file flag) expects strict client certificates for all HTTP endpoint consumers.
When deployed on k8s, k8s (kubelet) doesn't provide a client certificate when it probes readiness and liveness endpoints.
One needs to disable health check probes in the deployment manifests in order to deploy Prometheus with inbuilt TLS support on k8s.
See k8s documentation here (https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#http-probes). It says "'if the scheme field is set to HTTPS, the kubelet sends an HTTPS request skipping the certificate verification"
Can we move /-/ready and /-/healthy endpoints to a separate web server?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how the exporter-toolkit HTTP server handles /-/ready, /-/healthy, and the --web.config.file TLS configuration. Review the Kubernetes probe requirements and existing server behavior first; done means health endpoints remain probeable without client certificates while other endpoints retain the intended TLS behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- backend
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100