cadvisor: TLS在提供密钥和证书时不工作

Question

根据cadvisor文档(https://github.com/google/cadvisor/blob/master/docs/runtime_options.md#metrics)使用选项collector_cert和collector_key应该在Prometheus端点上启用TLS。

我已经使用以下命令启动了cadvisor容器:docker run --rm -d --volume=/:/rootfs:ro --volume=/tmp/cadvisor.crt:/etc/ssl/cadvisor.crt --volume=/tmp/cadvisor.key:/etc/ssl/cadvisor.key --volume=/var/run:/var/run:rw --volume=/sys:/sys:ro --volume=/var/lib/docker/:/var/lib/docker:ro --publish=8080:8080 --name=cadvisor gcr.io/cadvisor/cadvisor:latest --collector_cert=/etc/ssl/cadvisor.crt --collector_key=/etc/ssl/cadvisor.key

，但当我尝试使用curl https://127.0.0.1:8080/metrics -v访问指标时，我得到以下错误:

* Trying 127.0.0.1:8080...
* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 8080 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* error:1408F10B:SSL routines:ssl3_get_record:wrong version number
* Closing connection 0
curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number

另一方面，使用curl http://127.0.0.1:8080/metrics -v返回docker主机指标

*   Trying 127.0.0.1:8080...
* TCP_NODELAY set
% Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
Dload  Upload   Total   Spent    Left  Speed
0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0* Connected to 127.0.0.1 (127.0.0.1) port 8080 (#0)
> GET /metrics HTTP/1.1
> Host: 127.0.0.1:8080
> User-Agent: curl/7.68.0
> Accept: */*
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Content-Type: text/plain; version=0.0.4; charset=utf-8
< Date: Mon, 01 Feb 2021 11:03:33 GMT
< Transfer-Encoding: chunked
< 
{ [12148 bytes data]
100  300k    0  300k    0     0  4421k      0 --:--:-- --:--:-- --:--:-- 4357k
* Connection #0 to host 127.0.0.1 left intact

请指教。

Answer 1

据我所知，cAdvisor中没有https支持。也许你可以使用反向代理?在github上有一个相同主题的问题:https://github.com/google/cadvisor/issues/2539

这些标志用于从启用了TLS身份验证的另一个端点收集数据。