0ff173efea
Running sslscan against the prometheus adapter secure port reports two insecure SSL ciphers, ECDHE-RSA-DES-CBC3-SHA and DES-CBC3-SHA. This commit removes those ciphers from the list. Signed-off-by: fpetkovski <filip.petkovsky@gmail.com>
64 lines
2.3 KiB
YAML
64 lines
2.3 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/component: metrics-adapter
|
|
app.kubernetes.io/name: prometheus-adapter
|
|
app.kubernetes.io/part-of: kube-prometheus
|
|
app.kubernetes.io/version: 0.8.4
|
|
name: prometheus-adapter
|
|
namespace: monitoring
|
|
spec:
|
|
replicas: 2
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/component: metrics-adapter
|
|
app.kubernetes.io/name: prometheus-adapter
|
|
app.kubernetes.io/part-of: kube-prometheus
|
|
strategy:
|
|
rollingUpdate:
|
|
maxSurge: 1
|
|
maxUnavailable: 1
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/component: metrics-adapter
|
|
app.kubernetes.io/name: prometheus-adapter
|
|
app.kubernetes.io/part-of: kube-prometheus
|
|
app.kubernetes.io/version: 0.8.4
|
|
spec:
|
|
containers:
|
|
- args:
|
|
- --cert-dir=/var/run/serving-cert
|
|
- --config=/etc/adapter/config.yaml
|
|
- --logtostderr=true
|
|
- --metrics-relist-interval=1m
|
|
- --prometheus-url=http://prometheus-k8s.monitoring.svc.cluster.local:9090/
|
|
- --secure-port=6443
|
|
- --tls-cipher-suites=TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA
|
|
image: directxman12/k8s-prometheus-adapter:v0.8.4
|
|
name: prometheus-adapter
|
|
ports:
|
|
- containerPort: 6443
|
|
volumeMounts:
|
|
- mountPath: /tmp
|
|
name: tmpfs
|
|
readOnly: false
|
|
- mountPath: /var/run/serving-cert
|
|
name: volume-serving-cert
|
|
readOnly: false
|
|
- mountPath: /etc/adapter
|
|
name: config
|
|
readOnly: false
|
|
nodeSelector:
|
|
kubernetes.io/os: linux
|
|
serviceAccountName: prometheus-adapter
|
|
volumes:
|
|
- emptyDir: {}
|
|
name: tmpfs
|
|
- emptyDir: {}
|
|
name: volume-serving-cert
|
|
- configMap:
|
|
name: adapter-config
|
|
name: config
|