We're running our kubelet's with readOnlyPort (tcp/10255, plaintext HTTP) enabled and use that port to scrape kubelet and cadvisor metrics. With proper RBAC rules and client cert authentication in place for prometheus, we should be in a position to disable the readOnlyPort and use the default kubelet port (tcp/10250) instead.
Description
Description
Details
Details
Related Changes in Gerrit:
Customize query in gerrit
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | JMeybohm | T341984 Update Kubernetes clusters to 1.31 | |||
| Resolved | JMeybohm | T383413 Remove the kubelet readOnlyPort |
Event Timeline
Comment Actions
Change #1109728 had a related patch set uploaded (by JMeybohm; author: JMeybohm):
[operations/deployment-charts@master] admin_ng RBAC: Fix prometheus clusterrole
Comment Actions
Change #1109733 had a related patch set uploaded (by JMeybohm; author: JMeybohm):
[operations/puppet@production] kubelet: Use the chained certificate for TLS
Comment Actions
Change #1109734 had a related patch set uploaded (by JMeybohm; author: JMeybohm):
[operations/puppet@production] prometheus::k8s: Move away from kubelet readOnlyPort
Comment Actions
Change #1109735 had a related patch set uploaded (by JMeybohm; author: JMeybohm):
[operations/puppet@production] kubelet: Disable the readOnlyPort
Comment Actions
Change #1109728 merged by jenkins-bot:
[operations/deployment-charts@master] admin_ng RBAC: Fix prometheus clusterrole
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2025-01-13T11:51:19Z] <jayme> disabling puppet on all hosts running kubelet - T383413
Comment Actions
Change #1109733 merged by JMeybohm:
[operations/puppet@production] kubelet: Use the chained certificate for TLS
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2025-01-13T11:57:55Z] <jayme> re-enabling puppet on all hosts running kubelet - T383413
Comment Actions
Change #1109734 merged by JMeybohm:
[operations/puppet@production] prometheus::k8s: Move away from kubelet readOnlyPort
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2025-01-13T14:41:56Z] <jayme> disabling puppet on all hosts running kubelet - T383413
Comment Actions
Change #1109735 merged by JMeybohm:
[operations/puppet@production] kubelet: Disable the readOnlyPort
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2025-01-13T14:48:28Z] <jayme> re-enabling puppet on all hosts running kubelet - T383413