MON-3991: set noProxy for Prometheus remote-write via the CR.

[machine424]

this is a 'permanent' fix for https://issues.redhat.com/browse/OCPBUGS-38289

• I added CHANGELOG entry for this change.
• No user facing changes, so no entry in CHANGELOG was needed.

[openshift-ci-robot]

@machine424: This pull request references MON-3991 which is a valid jira issue.

In response to this:

this is a 'permanent' fix for https://issues.redhat.com/browse/OCPBUGS-38289

• I added CHANGELOG entry for this change.
• No user facing changes, so no entry in CHANGELOG was needed.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: machine424

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [machine424]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[simonpasquier]

Shouldn't we rather set rw.ProxyFromEnvironment = true and inject the proxy variables? This way Prometheus would select the correct proxy based on HTTP/HTTPS.

[openshift-ci]

@machine424: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[machine424]

Shouldn't we rather set rw.ProxyFromEnvironment = true and inject the proxy variables? This way Prometheus would select the correct proxy based on HTTP/HTTPS.

TBH, given the latest regression, I don't want to touch/change the logic: CMO gives priority to HTTPS proxy and set it. And no body is complaining about that for now.

Plus, given all the possible places in Prometheus where proxying can be set (scraping, remote wr, read etc) and even though prometheus operator isn't exposing all of that for now, I think it's better to be explicit (set the proxy in the CR) especially that users may need to have a different proxy for each part.

[simonpasquier]

Fair enough but in this case, CMO should look at the scheme of the remote-write URL to decide whether it needs to set proxy_url to HTTProxy() or HTTPSProxy().

[machine424]

Fair enough but in this case, CMO should look at the scheme of the remote-write URL to decide whether it needs to set proxy_url to HTTProxy() or HTTPSProxy().

Actually that's the behavior I'm avoiding to change: maybe some users are expecting/relying on the fact that the httpsproxy is always prioritized... That's why I think it's safer to keep it like this until someone complains about it.
(We could mention that here

cluster-monitoring-operator/Documentation/api.md

Line 525 in c5668e3

| proxyUrl | string | Defines an optional proxy URL. It is superseded by the cluster-wide proxy, if enabled. |

)

[simonpasquier]

maybe some users are expecting/relying on the fact that the httpsproxy is always prioritized

Hmm I'm not sure that it would make sense but indeed it can be tackled with another JIRA ticket.

cc @jan--f for another view point :)

[jan--f]

Afaiu http proxies work very differently from https proxies and generally one can't assume the url scheme corresponds to the the proxy to be used. E.g. sending https to an http proxy is a valid setup.
Not changing behavior seems like a good strategy here, maybe with a log message to make this behavior more visible if anyone cares to look?