Kruize cannot connect to to thanos datasource on Openshift 4.21

[lukasz-bielinski]

Hi, I've deployed kruize operator from OpenShift operator hub on OpenShift 4.21 and deployed kruize cr with cluster_type OpenShift.

Unfortunately in kruize pod I see error while connecting to thanos-querier:
"an unexpected error occurred while accessing datasource thanos-1 details: (protocol version)"

kruize-operator version:0.0.5.
autotune_operator:0.9
kruize:ui:0.1.0
kruize-optimiser:0.0.1

could you please point me what might be an issue?

EDIT: I am not sure if this is related - but I use KubeletConfig with tlsSecurityProfile: modern for all mcp pools - which enforce tls 1.3
EDIT2: I've downgraded tlsSecurityProfile to intermediate but it did not help

[shreyabiradar07]

@lukasz-bielinski Thanks for trying Kruize on Openshift. Can you please share more details on how to reproduce this issue?

Also please provide the following information:

1. Complete Error Details
   Please share the full error message and stack trace from the Kruize pod:

oc logs deployment/kruize -n openshift-tuning

2. Thanos Querier Logs
   Check if Thanos is receiving connection attempts from Kruize:

oc logs deployment/thanos-querier -n openshift-monitoring --tail=50

3. Connection Test
   From within the Kruize pod, test connectivity to Thanos:
   oc exec deployment/kruize -n openshift-tuning -- curl -v https://thanos-querier.openshift-monitoring.svc:9091/api/v1/query?query=up

4. TLS/Security Context
   Since you mentioned using tlsSecurityProfile: modern:

• What TLS version does your Thanos Querier support?

• Did you restart the Kruize pod after changing the TLS profile to intermediate?

• Are there any network policies or service mesh configurations that might affect the connection?

Additional Context
The operator automatically configures the thanos-1 datasource to connect to thanos-querier.openshift-monitoring.svc using bearer token authentication. The "(protocol version)" error typically suggests a TLS handshake failure or HTTP protocol mismatch between Kruize and Thanos.

[shreyabiradar07]

@lukasz-bielinski I've verified the TLS downgrade behavior and can confirm it resolves the Thanos connection error.

After downgrading from modern to intermediate profile, the Kruize pods need to be replaced for the change to take effect. The pods should automatically get replaced during the TLS profile change, but if they don't, you can trigger it manually:

oc delete pod -n openshift-tuning -l app=kruize

Once the new pods are running, the Thanos connection should work:

Before (with modern profile):

2026-05-0414:25:52.398 INFO [main][DataSourceCollection.java(101)]-Trying to add the datasource to collection: thanos-1 - https://thanos-querier.openshift-monitoring.svc.cluster.local:9091
2026-05-0414:25:52.398 INFO [main][DataSourceCollection.java(112)]-Verifying datasource reachability status: thanos-1
2026-05-0414:25:52.466 ERROR [main][DataSourceCollection.java(235)]-An unexpected error occurred while accessing datasource thanos-1 details: (protocol_version) Received fatal alert: protocol_version
2026-05-0414:25:52.467 ERROR [main][Autotune.java(170)]-Datasource connection refused or timed out.No datasource could be added or are serviceable. Failures: [prometheus-1: (protocol_version) Received fatal alert: protocol_version, thanos-1: (protocol_version) Received fatal alert: protocol_version]

After (with intermediate profile and new pods):

2026-05-0414:42:45.790 INFO [main][DataSourceCollection.java(101)]-Trying to add the datasource to collection: thanos-1 - https://thanos-querier.openshift-monitoring.svc.cluster.local:9091
2026-05-0414:42:45.790 INFO [main][DataSourceCollection.java(112)]-Verifying datasource reachability status: thanos-1
2026-05-0414:42:45.980 INFO [main][DataSourceCollection.java(115)]-Datasource is serviceable.
2026-05-0414:42:45.983 INFO [main][ExperimentDAOImpl.java(758)]-kruizeAuthenticationEntry: com.autotune.database.table.KruizeAuthenticationEntry@7b9fea11
2026-05-0414:42:45.990 INFO [main][DataSourceCollection.java(119)]-Auth details added to the DB successfully.
2026-05-0414:42:46.000 INFO [main][DataSourceCollection.java(123)]-Datasource added to the database successfully.
2026-05-0414:42:46.000 INFO [main][DataSourceCollection.java(134)]-Datasource added to the collection successfully.
2026-05-0414:42:46.000 INFO [main][DataSourceCollection.java(244)]-Datasource add summary: successCount=2, failures=0
2026-05-0414:42:46.001 INFO [main][Autotune.java(253)]-Checking available datasources:
2026-05-0414:42:46.001 INFO [main][Autotune.java(262)]-Datasource found: thanos-1, https://thanos-querier.openshift-monitoring.svc.cluster.local:9091
2026-05-0414:42:46.001 INFO [main][Autotune.java(262)]-Datasource found: prometheus-1, https://prometheus-k8s.openshift-monitoring.svc.cluster.local:9091

Could you verify if the Kruize pods were replaced after the TLS downgrade? Check with:
oc get pods -n openshift-tuning -o wide
Look at the AGE column - the pods should be relatively new (created after the TLS profile change). If they're still old, delete them to force replacement.

If the issue persists after pod replacement, please share:

• Kruize pod logs:
  oc logs <kruize-pod-name> -n openshift-tuning | grep -i "datasource\|thanos\|error"

• TLS configuration on the Ingress Controller:
  oc get ingresscontroller default -n openshift-ingress-operator -o yaml | grep -A5 tlsSecurityProfile

• Thanos service endpoint details:
  oc get route -n openshift-monitoring | grep thanos and oc get service thanos-querier -n openshift-monitoring -o yaml

This will help identify if the TLS profile change was applied correctly or if there's another configuration issue.

Edit: Downgrade both APIServer and KubeletConfig to Intermediate TLS profile.

[shreyabiradar07]

@lukasz-bielinski The Thanos datasource connection failure with "protocol version" error when using modern TLS security profiles has been fixed as part of PR kruize/autotune#1895 .

Root Cause: The SSL configuration was hardcoded to use TLSv1.2 which conflicted with modern TLS security profiles that require newer protocol versions.

Solution: Updated the SSL configuration to pass null for the enabled protocols parameter. This allows the SSL/TLS stack to use the system's default configuration and enables automatic version negotiation, ensuring compatibility with modern TLS security profiles.

[lukasz-bielinski]

Great news! Thanks for the update

…

On Fri, 8 May 2026, 07:52 Shreya Biradar, ***@***.***> wrote: *shreyabiradar07* left a comment (kruize/kruize-operator#93) <#93 (comment)> @lukasz-bielinski <https://github.com/lukasz-bielinski> The Thanos datasource connection failure with "protocol version" error when using modern TLS security profiles has been fixed as part of PR kruize/autotune#1895 <kruize/autotune#1895> . Root Cause: The SSL configuration was hardcoded to use TLSv1.2 which conflicted with modern TLS security profiles that require newer protocol versions. Solution: Updated the SSL configuration to pass null for the enabled protocols parameter. This allows the SSL/TLS stack to use the system's default configuration and enables automatic version negotiation, ensuring compatibility with modern TLS security profiles. — Reply to this email directly, view it on GitHub <#93 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADIGTTNXTLCJFE2R3S5B3UT4ZVY3XAVCNFSM6AAAAACYK3AFL2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DIMBTG43TEMJWGQ> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[shreyabiradar07]

@lukasz-bielinski The modern TLS profile (TLS 1.3) support has been added in Autotune 0.10, bundled with Kruize Operator version 0.0.6. Since you're currently running version 0.0.5, installing the latest version should resolve thanos connection issue.