Add insecureSkipVerify option for Prometheus and Graphite

artifacts/flagger/crd.yaml

@@ -1122,6 +1122,9 @@ spec:
  region:
  description: Region of the provider
  type: string
+ insecureSkipVerify:
+ description: Disable SSL certificate validation for the provider address
+ type: boolean
  query:
  description: Query of this metric template
  type: string

charts/flagger/crds/crd.yaml

@@ -1122,6 +1122,9 @@ spec:
  region:
  description: Region of the provider
  type: string
+ insecureSkipVerify:
+ description: Disable SSL certificate validation for the provider address
+ type: boolean
  query:
  description: Query of this metric template
  type: string

kustomize/base/flagger/crd.yaml

@@ -1122,6 +1122,9 @@ spec:
  region:
  description: Region of the provider
  type: string
+ insecureSkipVerify:
+ description: Disable SSL certificate validation for the provider address
+ type: boolean
  query:
  description: Query of this metric template
  type: string

pkg/apis/flagger/v1beta1/metric.go

@@ -74,6 +74,10 @@ type MetricTemplateProvider struct {
  // Region of the provider
  // +optional
  Region string `json:"region,omitempty"`
+
+ // InsecureSkipVerify disables certificate verification for the provider
+ // +optional
+ InsecureSkipVerify bool `json:"insecureSkipVerify,omitempty"`
 }
 
 // MetricTemplateModel is the query template model

pkg/metrics/providers/graphite.go

@@ -18,6 +18,7 @@ package providers
 
 import (
  "context"
+ "crypto/tls"
  "encoding/json"
  "fmt"
  "io/ioutil"
@@ -104,6 +105,7 @@ type GraphiteProvider struct {
  username string
  password string
  timeout time.Duration
+ client *http.Client
 }
 
 // NewGraphiteProvider takes a provider spec and credentials map,
@@ -119,6 +121,13 @@ func NewGraphiteProvider(provider flaggerv1.MetricTemplateProvider, credentials
  graph := GraphiteProvider{
  url: *graphiteURL,
  timeout: 5 * time.Second,
+ client: http.DefaultClient,
+ }
+
+ if provider.InsecureSkipVerify {
+ t := http.DefaultTransport.(*http.Transport).Clone()
+ t.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
+ graph.client = &http.Client{Transport: t}
  }
 
  if provider.SecretRef == nil {
@@ -168,7 +177,7 @@ func (g *GraphiteProvider) RunQuery(query string) (float64, error) {
  ctx, cancel := context.WithTimeout(req.Context(), g.timeout)
  defer cancel()
 
- r, err := http.DefaultClient.Do(req.WithContext(ctx))
+ r, err := g.client.Do(req.WithContext(ctx))
  if err != nil {
  return 0, fmt.Errorf("request failed: %w", err)
  }

pkg/metrics/providers/prometheus.go

@@ -18,6 +18,7 @@ package providers
 
 import (
  "context"
+ "crypto/tls"
  "encoding/json"
  "fmt"
  "io/ioutil"
@@ -39,6 +40,7 @@ type PrometheusProvider struct {
  url url.URL
  username string
  password string
+ client *http.Client
 }
 
 type prometheusResponse struct {
@@ -64,6 +66,13 @@ func NewPrometheusProvider(provider flaggerv1.MetricTemplateProvider, credential
  prom := PrometheusProvider{
  timeout: 5 * time.Second,
  url: *promURL,
+ client: http.DefaultClient,
+ }
+
+ if provider.InsecureSkipVerify {
+ t := http.DefaultTransport.(*http.Transport).Clone()
+ t.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
+ prom.client = &http.Client{Transport: t}
  }
 
  if provider.SecretRef != nil {
@@ -106,7 +115,7 @@ func (p *PrometheusProvider) RunQuery(query string) (float64, error) {
  ctx, cancel := context.WithTimeout(req.Context(), p.timeout)
  defer cancel()
 
- r, err := http.DefaultClient.Do(req.WithContext(ctx))
+ r, err := p.client.Do(req.WithContext(ctx))
  if err != nil {
  return 0, fmt.Errorf("request failed: %w", err)
  }