alertmanager: allow disable dashboard tls verify

When using self-signed/untrusted CA certificates, alertmanager displays
an error in logs. With this commit this should make those messages
disappear.

Closes: https://bugzilla.redhat.com/show_bug.cgi?id=1936299
Co-authored-by: Guillaume Abrioux <gabrioux@redhat.com>
Signed-off-by: Dimitri Savineau <dsavinea@redhat.com>
(cherry picked from commit 9f77b929d145512e0d8886b96caf6047c5072a68)

diff --git a/group_vars/all.yml.sample b/group_vars/all.yml.sample
index 7a6ff86d529f6d4d6aee409c959231028a1c8301..06a46d5e8b139d4caab34229e03f05e48a41e963 100644 (file)
--- a/group_vars/all.yml.sample
+++ b/group_vars/all.yml.sample
@@ -821,6 +821,7 @@ dummy:
 #alertmanager_port: 9093
 #alertmanager_cluster_port: 9094
 #alertmanager_conf_overrides: {}
+#alertmanager_dashboard_api_no_ssl_verify: "{{ true if dashboard_protocol == 'https' and not dashboard_crt and not dashboard_key else false }}"
 # igw
 #
 # `igw_network` variable is intended for allowing dashboard deployment with iSCSI node not residing in the same subnet than what is defined in `public_network`.

diff --git a/group_vars/rhcs.yml.sample b/group_vars/rhcs.yml.sample
index 43e90ae52a2a46a6e4e39db7177940f22943fb85..7e9fe30e9838274104d817059156fa2e6fb37f95 100644 (file)
--- a/group_vars/rhcs.yml.sample
+++ b/group_vars/rhcs.yml.sample
@@ -821,6 +821,7 @@ alertmanager_container_image: registry.redhat.io/openshift4/ose-prometheus-alert
 #alertmanager_port: 9093
 #alertmanager_cluster_port: 9094
 #alertmanager_conf_overrides: {}
+#alertmanager_dashboard_api_no_ssl_verify: "{{ true if dashboard_protocol == 'https' and not dashboard_crt and not dashboard_key else false }}"
 # igw
 #
 # `igw_network` variable is intended for allowing dashboard deployment with iSCSI node not residing in the same subnet than what is defined in `public_network`.

diff --git a/roles/ceph-defaults/defaults/main.yml b/roles/ceph-defaults/defaults/main.yml
index fe4408ae9dbefbab45ea15f3c838489c14bb92c9..4a8c557219a6eb012cc17182d3db951324674e94 100644 (file)
--- a/roles/ceph-defaults/defaults/main.yml
+++ b/roles/ceph-defaults/defaults/main.yml
@@ -813,6 +813,7 @@ alertmanager_conf_dir: /etc/alertmanager
 alertmanager_port: 9093
 alertmanager_cluster_port: 9094
 alertmanager_conf_overrides: {}
+alertmanager_dashboard_api_no_ssl_verify: "{{ true if dashboard_protocol == 'https' and not dashboard_crt and not dashboard_key else false }}"
 # igw
 #
 # `igw_network` variable is intended for allowing dashboard deployment with iSCSI node not residing in the same subnet than what is defined in `public_network`.

diff --git a/roles/ceph-prometheus/templates/alertmanager.yml.j2 b/roles/ceph-prometheus/templates/alertmanager.yml.j2
index 2ca58f417e7440f4ac7e6c79395a1266f64067c6..63dfbf701433e5626af4b372ae00a598c9137ccf 100644 (file)
--- a/roles/ceph-prometheus/templates/alertmanager.yml.j2
+++ b/roles/ceph-prometheus/templates/alertmanager.yml.j2
@@ -12,4 +12,9 @@ receivers:
   webhook_configs:
 {% for host in groups['mgrs'] | default(groups['mons']) %}
   - url: '{{ dashboard_protocol }}://{{ hostvars[host]['ansible_facts']['fqdn'] }}:{{ dashboard_port }}/api/prometheus_receiver'
+{% if dashboard_protocol == 'https' and alertmanager_dashboard_api_no_ssl_verify | bool %}
+    http_config:
+      tls_config:
+        insecure_skip_verify: true
+{% endif %}
 {% endfor %}