Fix apiserver scraper TLS config

Author: jefchien

charts/amazon-cloudwatch-observability/templates/linux/_otel-container-insights-cluster-scraper-config.tpl

@@ -17,6 +17,12 @@ receivers:
           tls_config:
             ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
             insecure_skip_verify: false
+            {{- if eq .Values.k8sMode "AKS" }}
+            # Endpoints SD dials the apiserver by IP. On AKS the managed control-plane endpoint IP is
+            # not in the serving cert's SANs (only DNS names + the ClusterIP are), so verify against a
+            # DNS SAN instead. On EKS the endpoint IPs are in the SANs, so this is not needed there.
+            server_name: kubernetes.default.svc
+            {{- end }}
           bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
           kubernetes_sd_configs:
             - role: endpoints

integration-tests/amazon-cloudwatch-observability/terraform/minikube/scenarios/default/main.tf

@@ -11,7 +11,8 @@ resource "null_resource" "validator" {
   depends_on = [module.base.helm_release]
 
   provisioner "local-exec" {
-    command = "go test ${var.test_dir} -v -run=TestDefault"
+    # Anchored so it does not also match TestDefault*.
+    command = "go test ${var.test_dir} -v -run='TestDefault$'"
   }
 }
 

integration-tests/amazon-cloudwatch-observability/validations/minikube/scenarios/aks_otel_container_insights_test.go

@@ -76,6 +76,9 @@ func TestAKSOtelContainerInsights(t *testing.T) {
 	t.Run("WebhookEnforcerDisabled", func(t *testing.T) {
 		validateAKSWebhookEnforcerDisabled(t, k8sClient)
 	})
+	t.Run("ApiserverTLSServerName", func(t *testing.T) {
+		validateAKSApiserverTLSServerName(t, agentMap)
+	})
 
 	t.Log("AKS OTEL Container Insights scenario validation passed")
 }
@@ -155,6 +158,18 @@ func validateOTELConfigRoutingAKS(t *testing.T, agentMap map[string]unstructured
 	}
 }
 
+// validateAKSApiserverTLSServerName checks the apiserver scrape verifies TLS against a DNS SAN. On
+// AKS, endpoints SD dials the managed control-plane IP, which is absent from the serving cert's SANs,
+// so without server_name every scrape fails TLS and no apiserver metrics reach CloudWatch.
+func validateAKSApiserverTLSServerName(t *testing.T, agentMap map[string]unstructured.Unstructured) {
+	scraper := otelConfigOf(t, agentMap, "cloudwatch-agent-cluster-scraper")
+	if scraper == "" {
+		return
+	}
+	assert.True(t, strings.Contains(scraper, "server_name: kubernetes.default.svc"),
+		"cluster-scraper otelConfig should set server_name for the apiserver TLS scrape on AKS")
+}
+
 // validateAKSServiceAttributes checks the AKS-gated service.*/deployment.environment.name are on the
 // node agent but NOT the cluster-scraper (scraper metrics describe other workloads, not its own).
 func validateAKSServiceAttributes(t *testing.T, agentMap map[string]unstructured.Unstructured) {