mirror of
https://github.com/project-zot/zot.git
synced 2026-06-15 11:37:56 +08:00
Ramkumar Chinchani
b47b643e05
* fix(security): remove InsecureSkipVerify from metrics client (TLS-1) Replace the unconditional InsecureSkipVerify: true TLS config in newHTTPMetricsClient with the system cert pool (+ TLS 1.2 minimum). Add an optional CACert field to MetricsConfig and to the exporter ServerConfig so operators running zot with a self-signed or private CA can point the exporter at the correct CA file instead of disabling certificate verification entirely. Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com> * feat(metrics): add HTTPS configuration for metrics exporter Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com> * fix(security): enhance CA certificate handling in metrics client and add tests Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com> * fix(security): improve CA certificate error handling in metrics client and update tests Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com> * fix(tests): correct package name in minimal_client_test.go and simplify error declaration Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com> * fix(tests): update package name in minimal_client_test.go for consistency Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com> --------- Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com>
A quick zot Metrics setup can be deployed locally in a kind cluster. It contains:
- a Prometheus server deployed through an Operator
- a dist-spec-only zot deployment (a pod with 2 containers: the zot server & the node exporter)
- a zot with all extensions enabled
Prerequisites
In case the prerequisites tool list is not fulfilled the script will install them (needs root privileges)
Metrics setup
To run a quick setup:
./kind-setup.sh
At the end of the script below ports are locally available (using kubectl port-forward) to easy access the Prometheus & zot servers on the host:
- 9090 - for accessing Prometheus server
- 5000 - for zot with all extensions enabled
- 5050 - for accessing dist-spec-only zot server
- 5051 - for zxp access (a Prometheus Node exporter)