prometheus / prometheus/node_exporter
[BUG] Cannot run `healthcheck` with `wget` for `node-exporter` when running with TLS
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 13.8k
- Forks
- 2.7k
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 8
Description
Bug description
Hi,
I'm trying to run a Node Exporter server with TLS using prom/node-exporter:latest and set a valid health check command.
node-exporter works just fine by adding the necessary TLS settings in -web.config.file=/var/config/web-config.yaml. The problem is actually with the tool that I've been using to run the healthcheck, which is wget, which comes from busybox:1.36.1.
This is a known issue for busybox:1.36.1 (see https://github.com/docker-library/busybox/issues/162). Specifically, if I run from within the container the command:
wget -q --spider --no-check-certificate https://localhost:9100/metrics
I get the following error on amd64 machines:
wget: TLS error from peer (alert code 40): handshake failure
wget: error getting response: Connection reset by peer
This error has been fixed within busybox:1.37. Therefore, I would ask the team to update the quay.io/prometheus/busybox-${OS}-${ARCH}:latest to use busybox:1.37 and then provide a newer prom/node-exporter image.
Alternatively, any suggestion on how to set an healthcheck command for node-exporter when running with TLS would be highly appreciated. prom/prometheus provides promtool to run healthchecks also with TLS, but there's no equivalent tool for node-exporter.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the reported wget command against a TLS-enabled node-exporter container, comparing busybox:1.36.1 with busybox:1.37 on amd64. Done means a newer node-exporter image is available with a healthcheck that succeeds over TLS, or documented guidance identifies a working alternative.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, go
- Domain
- devops, observability
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100