<p>Im trying to update the <code>tls-cipher-suites</code> for the <code>daemonset.apps/node-exporter</code> of <code>openshift-monitoring</code> namespace using <code>oc edit daemonset.apps/node-exporter -n openshift-monitoring</code></p>
<pre><code>.
.
.
      - args:
        - --secure-listen-address=:9100
        - --upstream=http://127.0.0.1:9101/
        - --tls-cert-file=/etc/tls/private/tls.crt
        - --tls-private-key-file=/etc/tls/private/tls.key
        - --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
        image: quay.io/coreos/kube-rbac-proxy:v0.3.1
        imagePullPolicy: IfNotPresent
        name: kube-rbac-proxy
        ports:
.
.
.
</code></pre>
<p>Once the <code>tls-cipher-suites</code> are updated, i see that node-exporter pods are getting re-deployed. But when I check the <code>daemonset.apps/node-exporter</code> using <code>oc get -o yaml daemonset.apps/node-exporter -n openshift-monitoring</code> i see that the updates done to <code>tls-cipher-suites</code> are lost and it has got re-set to old value.
How can i set this value permanently?</p>
<p>Note: The purpose of updating <code>tls-cipher-suites</code> is Nessus scan has reported <code>SWEET32</code> vulnerability for port 9100 for the Medium Strength Ciphers: ECDHE-RSA-DES-CBC3-SHA and DES-CBC3-SHA.</p>

Rakesh Kotian
<p>Openshift 3.11 seems to indeed be using <a href="https://github.com/openshift/openshift-ansible/tree/release-3.11/roles/openshift_cluster_monitoring_operator" rel="nofollow noreferrer">openshift_cluster_monitoring_operator</a>. This is why when you delete or change anything it recovers it to its defaults.</p>
<p>It manages node-exporter installation and it doesn't seem to allow for customizing node-exporter installation. Take a look at <a href="https://github.com/openshift/cluster-monitoring-operator/blob/ca646cfdb92b202289c3faf92227fcaddd19c8a1/Documentation/user-guides/configuring-cluster-monitoring.md#nodeexporterconfig" rel="nofollow noreferrer">the cluster-monitoring-operator docs</a></p>
<p>My recommendation would be to <a href="https://github.com/openshift/openshift-ansible/tree/release-3.11/roles/openshift_cluster_monitoring_operator#installation" rel="nofollow noreferrer">uninstall openshift monitoring operator</a> and install node-exporter yourself from <a href="https://github.com/prometheus-operator/kube-prometheus/blob/master/manifests/node-exporter-daemonset.yaml" rel="nofollow noreferrer">official node-exporter repository</a> or with <a href="https://github.com/prometheus-community/helm-charts" rel="nofollow noreferrer">helm chart</a> where you actually have full controll over deployment.</p>
