prometheus / prometheus/node_exporter

[BUG] Cannot run `healthcheck` with `wget` for `node-exporter` when running with TLS

Open
#3,496 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
13.8k
Forks
2.7k
Avg merge
1d 23h
Merged PRs (30d)
8

Description

Bug description

Hi,
I'm trying to run a Node Exporter server with TLS using prom/node-exporter:latest and set a valid health check command.
node-exporter works just fine by adding the necessary TLS settings in -web.config.file=/var/config/web-config.yaml. The problem is actually with the tool that I've been using to run the healthcheck, which is wget, which comes from busybox:1.36.1.

This is a known issue for busybox:1.36.1 (see https://github.com/docker-library/busybox/issues/162). Specifically, if I run from within the container the command:

wget -q --spider --no-check-certificate https://localhost:9100/metrics

I get the following error on amd64 machines:

wget: TLS error from peer (alert code 40): handshake failure
wget: error getting response: Connection reset by peer

This error has been fixed within busybox:1.37. Therefore, I would ask the team to update the quay.io/prometheus/busybox-${OS}-${ARCH}:latest to use busybox:1.37 and then provide a newer prom/node-exporter image.

Alternatively, any suggestion on how to set an healthcheck command for node-exporter when running with TLS would be highly appreciated. prom/prometheus provides promtool to run healthchecks also with TLS, but there's no equivalent tool for node-exporter.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the reported wget command against a TLS-enabled node-exporter container, comparing busybox:1.36.1 with busybox:1.37 on amd64. Done means a newer node-exporter image is available with a healthcheck that succeeds over TLS, or documented guidance identifies a working alternative.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, go
Domain
devops, observability
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.