feat: Add insecure option for Prometheus. Fixes #2913 (#2914)

* feat: Add insecure option for Prometheus Signed-off-by: Guillaume Doussin <[email protected]> * change grpc id Signed-off-by: zachaller <[email protected]> --------- Signed-off-by: Guillaume Doussin <[email protected]> Signed-off-by: zachaller <[email protected]> Co-authored-by: zachaller <[email protected]>
argoproj · Aug 4, 2023 · c9bc3bc · c9bc3bc
1 parent e2467fe
commit c9bc3bc
Show file tree

Hide file tree

Showing 13 changed files with 625 additions and 513 deletions.
diff --git a/docs/analysis/prometheus.md b/docs/analysis/prometheus.md
@@ -58,9 +58,27 @@ provider:
         roleArn: $ROLEARN
 ```
 
-# Additional Metadata
+## Additional Metadata
 
 Any additional metadata from the Prometheus controller, like the resolved queries after substituting the template's
 arguments, etc. will appear under the `Metadata` map in the `MetricsResult` object of `AnalysisRun`.
 
 
+
+## Skip TLS verification
+
+You can skip the TLS verification of the prometheus host provided by setting the options `insecure: true`.
+
+```yaml
+provider:
+  prometheus:
+    address: https://prometheus.example.com
+    insecure: true
+    query: |
+      sum(irate(
+        istio_requests_total{reporter="source",destination_service=~"{{args.service-name}}",response_code!~"5.*"}[5m]
+      )) /
+      sum(irate(
+        istio_requests_total{reporter="source",destination_service=~"{{args.service-name}}"}[5m]
+      ))
+```
diff --git a/docs/analysis/web.md b/docs/analysis/web.md
@@ -94,4 +94,22 @@ It is possible to use a POST or PUT requests, by specifying the `method` and eit
             nestedObj: nested value
             key3: "{{ args.service-name }}"
         jsonPath: "{$.data.ok}"
+```
+
+### Skip TLS verification
+
+You can skip the TLS verification of the web host provided by setting the options `insecure: true`.
+
+```yaml
+  metrics:
+  - name: webmetric
+    successCondition: "result.ok && result.successPercent >= 0.90"
+    provider:
+      web:
+        url: "https://my-server.com/api/v1/measurement?service={{ args.service-name }}"
+        insecure: true
+        headers:
+          - key: Authorization
+            value: "Bearer {{ args.api-token }}"
+        jsonPath: "{$.data}"
 ```
diff --git a/docs/features/kustomize/rollout_cr_schema.json b/docs/features/kustomize/rollout_cr_schema.json
@@ -4310,6 +4310,9 @@
                                                         },
                                                         "type": "object"
                                                     },
+                                                    "insecure": {
+                                                        "type": "boolean"
+                                                    },
                                                     "query": {
                                                         "type": "string"
                                                     },
@@ -8736,6 +8739,9 @@
                                                         },
                                                         "type": "object"
                                                     },
+                                                    "insecure": {
+                                                        "type": "boolean"
+                                                    },
                                                     "query": {
                                                         "type": "string"
                                                     },
@@ -13162,6 +13168,9 @@
                                                         },
                                                         "type": "object"
                                                     },
+                                                    "insecure": {
+                                                        "type": "boolean"
+                                                    },
                                                     "query": {
                                                         "type": "string"
                                                     },

diff --git a/manifests/crds/analysis-run-crd.yaml b/manifests/crds/analysis-run-crd.yaml
@@ -2809,6 +2809,8 @@ spec:
                                       type: string
                                   type: object
                               type: object
+                            insecure:
+                              type: boolean
                             query:
                               type: string
                             timeout:

diff --git a/manifests/crds/analysis-template-crd.yaml b/manifests/crds/analysis-template-crd.yaml
@@ -2805,6 +2805,8 @@ spec:
                                       type: string
                                   type: object
                               type: object
+                            insecure:
+                              type: boolean
                             query:
                               type: string
                             timeout:

diff --git a/manifests/crds/cluster-analysis-template-crd.yaml b/manifests/crds/cluster-analysis-template-crd.yaml
@@ -2805,6 +2805,8 @@ spec:
                                       type: string
                                   type: object
                               type: object
+                            insecure:
+                              type: boolean
                             query:
                               type: string
                             timeout:

diff --git a/manifests/install.yaml b/manifests/install.yaml
@@ -2810,6 +2810,8 @@ spec:
                                       type: string
                                   type: object
                               type: object
+                            insecure:
+                              type: boolean
                             query:
                               type: string
                             timeout:
@@ -5804,6 +5806,8 @@ spec:
                                       type: string
                                   type: object
                               type: object
+                            insecure:
+                              type: boolean
                             query:
                               type: string
                             timeout:
@@ -8684,6 +8688,8 @@ spec:
                                       type: string
                                   type: object
                               type: object
+                            insecure:
+                              type: boolean
                             query:
                               type: string
                             timeout:

diff --git a/metricproviders/prometheus/prometheus.go b/metricproviders/prometheus/prometheus.go
@@ -2,8 +2,10 @@ package prometheus
 
 import (
 	"context"
+	"crypto/tls"
 	"errors"
 	"fmt"
+	"net"
 	"net/http"
 	"net/url"
 	"os"
@@ -183,7 +185,17 @@ func NewPrometheusAPI(metric v1alpha1.Metric) (v1.API, error) {
 
 	prometheusApiConfig := api.Config{
 		Address: metric.Provider.Prometheus.Address,
+		RoundTripper: &http.Transport{
+			Proxy: http.ProxyFromEnvironment,
+			DialContext: (&net.Dialer{
+				Timeout:   30 * time.Second,
+				KeepAlive: 30 * time.Second,
+			}).DialContext,
+			TLSHandshakeTimeout: 10 * time.Second,
+			TLSClientConfig:     &tls.Config{InsecureSkipVerify: metric.Provider.Prometheus.Insecure},
+		},
 	}
+
 	//Check if using Amazon Managed Prometheus if true build sigv4 client
 	if strings.Contains(metric.Provider.Prometheus.Address, "aps-workspaces") {
 		cfg := sigv4.SigV4Config{

diff --git a/metricproviders/prometheus/prometheus_test.go b/metricproviders/prometheus/prometheus_test.go
@@ -453,6 +453,7 @@ func TestNewPrometheusAPI(t *testing.T) {
 	log.Infof("api:%v", api)
 
 	metric.Provider.Prometheus.Address = "https://www.example.com"
+	metric.Provider.Prometheus.Insecure = true
 	_, err = NewPrometheusAPI(metric)
 	assert.Nil(t, err)
 }

diff --git a/pkg/apis/rollouts/v1alpha1/analysis_types.go b/pkg/apis/rollouts/v1alpha1/analysis_types.go
@@ -216,6 +216,8 @@ type PrometheusMetric struct {
 	// Timeout represents the duration within which a prometheus query should complete. It is expressed in seconds.
 	// +optional
 	Timeout *int64 `json:"timeout,omitempty" protobuf:"bytes,4,opt,name=timeout"`
+	// Insecure skips host TLS verification
+	Insecure bool `json:"insecure,omitempty" protobuf:"varint,5,opt,name=insecure"`
 }
 
 // PrometheusMetric defines the prometheus query to perform canary analysis