Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Naive noProxy breaks OpenTelemetry components #3073

Open
krx252525 opened this issue May 31, 2023 · 0 comments
Open

Naive noProxy breaks OpenTelemetry components #3073

krx252525 opened this issue May 31, 2023 · 0 comments
Labels
bug Something isn't working

Comments

@krx252525
Copy link

Describe the bug
#3022 fixed an issue with the overzealous chomping of whitespace when specifying httpProxy and/or httpsProxy parameters in the helm chart.

However, the default sumologic.noProxy setting results in OpenTelemetry components breaking as everything except kubernetes.default.svc will get proxied, for example :::55678 gets proxied in otelcol-instrumentation.

I'm a bit confused why :::55678 is being used since we use a single stack IPv4 networking.

Logs
I can't share logs here but happy to open a support ticket if necessary

Command used to install/upgrade Collection
helm upgrade --install ...

Configuration
Mostly default for the purpose of this bug

sumologic:
    httpProxy: "http://someproxy.tld:3128"
    httpsProxy: "http://someproxy.tld:3128"
    # this is the default
    noProxy: kubernetes.default.svc

To Reproduce
Configure

Expected behavior A clear and concise description of what you expected to happen.
I would expect defining a proxy to work without having to inspect each of the individual components/

Environment (please complete the following information):

  • Collection version (e.g. helm ls -n sumologic):
    3.5.0 (but the same value is used in main)
  • Kubernetes version (e.g. kubectl version):
    1.24.11-gke.1000
  • Cloud provider:
    GCP
  • Others:
    N/A

Anything else do we need to know
This noProxy appears to work in place of the default and should serve as a sensible default:

sumologic:
  noProxy: '.cluster.local,.svc,::'

There are warnings stating in the otelcol logs:
"Using the 0.0.0.0 address exposes this server to every network interface, which may facilitate Denial of Service attacks"
As described in the otel-collector/security-best-practices.md. Following the advice there to use localhost in place of 0.0.0.0 makes the correct noProxy a bit easier on the eye, tested and appears to work (can't comment on IPv6):

sumologic:
  noProxy: .cluster.local,.svc,localhost
@krx252525 krx252525 added the bug Something isn't working label May 31, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant