Repository navigation
vmanomaly: add spec.server.tlsConfig to serve the UI over HTTPS - #2794
Open
fred-navruzov wants to merge 4 commits into
Open
fred-navruzov wants to merge 4 commits into
fred-navruzov wants to merge 4 commits into
Conversation
fred-navruzov
marked this pull request as ready for review
November 4, 2026 19:52
fred-navruzov
requested review from
AndrewChubatiuk,
Haleygo and
vrutkovs
as code owners
November 4, 2026 19:52
fred-navruzov
force-pushed
the
vmanomaly-server-tls
branch
from
November 4, 2026 19:56
4de1be6 to
545634a
Compare
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Review completed against the latest diff
Reply with feedback, questions, or to request a fix.
Turn on auto-fix | Re-trigger cubic
vrutkovs
reviewed
Nov 5, 2026
| // If ca or caFile is set, clients must present a certificate signed by this CA (mTLS). | ||
| // insecureSkipVerify and serverName are not supported. | ||
| // Probes and metrics scraping use the separate monitoring.pull port, which must differ from the server port. | ||
| // +optional |
Collaborator
There was a problem hiding this comment.
Suggested change
| // +optional | |
| // +notes={available_from: "v0.76.0"} | |
| // +optional |
Contributor
Author
There was a problem hiding this comment.
Added the v0.76.0 availability marker and regenerated docs/api.md with the pinned generator in 1f4e192.
|
|
||
| * BUGFIX: [vmoperator](https://docs.victoriametrics.com/operator/): respect `http.listenAddr` set in `spec.configReloaderExtraArgs` in all config-reloader related configs, such as the container port and health probes. Previously, it was hardcoded to `8435`, which caused config-reloader probes to fail when the listen address was overridden, and multiple `hostNetwork` instances on the same node to conflict. See [#2584](https://github.com/VictoriaMetrics/operator/issues/2584). Thanks to @cesium147. | ||
|
|
||
| * FEATURE: [vmanomaly](https://docs.victoriametrics.com/operator/resources/vmanomaly/): add `spec.server.tlsConfig` to serve the anomaly UI and API over HTTPS, with optional client certificate verification (mTLS) when `ca` or `caFile` is set. Probes and scraping keep using the plain HTTP `spec.monitoring.pull.port`. Requires vmanomaly v1.32.0 or newer. The `VMAnomaly` CRD must be updated to use this field. See [these docs](https://docs.victoriametrics.com/operator/resources/vmanomaly/#serving-the-ui-over-https) and [#2794](https://github.com/VictoriaMetrics/operator/pull/2794). |
Collaborator
There was a problem hiding this comment.
Don't forget to put it to the top on rebase
Contributor
Author
There was a problem hiding this comment.
Rebased on latest master and moved the TLS feature to the top of the tip changelog in 1f4e192. Targeted VMAnomaly configuration, API and VMAuth tests pass after the rebase.
Map spec.server.tlsConfig to the vmanomaly server TLS options (tls_cert_file, tls_key_file and, for mTLS, mtls_ca_file), using the same TLS asset handling as spec.reader.tlsConfig. Return an https URL for the resource when TLS is enabled, and reject settings that would make probes hit the TLS listener. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
fred-navruzov
force-pushed
the
vmanomaly-server-tls
branch
from
November 5, 2026 12:15
2d67093 to
1f4e192
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
VMAnomalycannot serve the anomaly UI and API over HTTPS. The operator builds the vmanomalyserversection from a fixed schema, so TLS options can't be set throughspec.server,configRawYamlorconfigSecret, and users need a TLS-terminating proxy in front of the UI.What
Add
spec.server.tlsConfig, reusing theTLSConfigtype already used byspec.reader.tlsConfig:spec.server.tlsConfigserveroptioncert/certFiletls_cert_filekeySecret/keyFiletls_key_fileca/caFile(optional, enables mTLS)mtls_ca_fileHow
BuildTLSCreds), so they are mounted the same way as reader, writer and monitoring TLS assets; file paths are passed through.VMAnomaly.Validate()requires a certificate and a key, and rejectsinsecureSkipVerifyandserverName, which have no server-side meaning.VMPodScrapealready targetspec.monitoring.pull.portover plain HTTP. Validation rejectsspec.server.portequal to that port when TLS is enabled, so probes never hit the TLS listener.AsURL()returnshttps://when TLS is enabled, so routing to the resource (for example fromVMUsertargetRef) uses the right scheme.docs/api.md; added a docs section and a CHANGELOG entry.Compatibility
spec.server.tlsConfigis unset.Tests
config_test.go: secret references with mTLS and pre-mounted files map to the expectedserveroptions.vmanomaly_types_test.go: validation cases and theAsURL()scheme.go testforapi/operator/v1,factory/vmanomaly/...andfactory/vmauth;go vetandgolangci-lintv2.15.0 report no issues.