Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Consider using http based kubelet authentication instead of hostmounted socket #1186

Open
esara opened this issue May 12, 2024 · 0 comments
Open

Comments

@esara
Copy link
Contributor

esara commented May 12, 2024

Is your feature request related to a problem? Please describe.
The current odigos collector kubelet authentication relies on hostmounted socket https://github.com/odigos-io/odigos/blob/main/collector/processors/odigosresourcenameprocessor/kubelet.go#L27

var (
	socketDir  = "/var/lib/kubelet/pod-resources"
	socketPath = "unix://" + socketDir + "/kubelet.sock"

	connectionTimeout = 10 * time.Second
)

type kubeletClient struct {
	conn         *grpc.ClientConn
	nameStrategy NameStrategy
}

func NewKubeletClient(ns NameStrategy) (*kubeletClient, error) {
	conn, err := connectToKubelet(socketPath)
	if err != nil {
		return nil, err
	}

	return &kubeletClient{
		conn:         conn,
		nameStrategy: ns,
	}, nil
}

Describe the solution you'd like
Instead of, we can use an http based authentication with incluster auth

func LoadKubeClientset() *kubernetes.Clientset {
	kubeconfig, err = rest.InClusterConfig()
	clientset, err := kubernetes.NewForConfig(kubeconfig)

without hostmount privilege

Describe alternatives you've considered
otherwise, we can add hostmount privilege (which requires an additional policy in Openshift for example)

Additional context
Related to #1128

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant