[
https://issues.apache.org/jira/browse/KUDU-3693?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18080880#comment-18080880
]
ASF subversion and git services commented on KUDU-3693:
-------------------------------------------------------
Commit 8882db7bd58d6fbdfd06a85b979a44fe4bce14d9 in kudu's branch
refs/heads/master from Marton Greber
[ https://gitbox.apache.org/repos/asf?p=kudu.git;h=8882db7bd ]
KUDU-3693: Add bearer token auth for Prometheus
Prometheus does not support SPNEGO, so scraping a secured Kudu cluster
requires an alternative authentication mechanism. Add
--webserver_prometheus_token_cmd: when set, designated Prometheus
endpoints (/metrics_prometheus, /prometheus-sd) accept an
"Authorization: Bearer <token>" header as an alternative to SPNEGO.
This allows Prometheus scrapers to authenticate on an otherwise
SPNEGO-secured cluster. Clients that do support SPNEGO (e.g.
curl --negotiate, Knox Gateway) can continue to use it on these
endpoints as before.
Adds unit tests in webserver-test.cc and integration tests in
prometheus_auth-itest.cc covering correct, wrong, and missing
token scenarios for both scrape and SD endpoints.
Example Prometheus configs for using the Bearer token:
Static scrape config:
global:
scrape_configs:
- job_name: kudu
metrics_path: /metrics_prometheus
scrape_interval: 2s
authorization:
type: Bearer
credentials: <webserver_prometheus_token>
static_configs:
- targets:
- 127.0.0.1:8050
- 127.0.0.1:8051
- 127.0.0.1:8052
SD scrape config:
global:
scrape_configs:
- job_name: kudu
metrics_path: /metrics_prometheus
scrape_interval: 2s
authorization:
type: Bearer
credentials: <webserver_prometheus_token>
http_sd_configs:
- url: http://127.0.0.1:8050/prometheus-sd
refresh_interval: 2s
authorization:
type: Bearer
credentials: <webserver_prometheus_token>
- url: http://127.0.0.1:8051/prometheus-sd
refresh_interval: 2s
authorization:
type: Bearer
credentials: <webserver_prometheus_token>
- url: http://127.0.0.1:8052/prometheus-sd
refresh_interval: 2s
authorization:
type: Bearer
credentials: <webserver_prometheus_token>
Change-Id: If8169196a2c49d64865095f3bc6da1d3bfbcecfb
Reviewed-on: http://gerrit.cloudera.org:8080/24278
Tested-by: Marton Greber <[email protected]>
Reviewed-by: Zoltan Chovan <[email protected]>
Reviewed-by: Gabriella Lotz <[email protected]>
> Prometheus endpoint auth
> ------------------------
>
> Key: KUDU-3693
> URL: https://issues.apache.org/jira/browse/KUDU-3693
> Project: Kudu
> Issue Type: Sub-task
> Reporter: Marton Greber
> Assignee: Marton Greber
> Priority: Major
>
> Prometheus does not support SPNEGO therefore it is necessary to figure out a
> solution that we can offer on secure deployments.
> Below are some options outlined:
> - have the prometheus endpoints have an auth on/off flag (in Impala if I've
> read correctly there is no security check for the metrics endpoints:
> https://github.com/apache/impala/blob/0cd240a1cbd25ef097f392cbc02a70ad0b5f11d6/fe/src/test/java/org/apache/impala/customcluster/LdapWebserverTest.java#L210-L213)
> - Use bearer token (Ozone does this as well:
> https://ozone.apache.org/docs/edge/feature/observability.html?utm_source=chatgpt.com
> )
> - Provide info how to setup with Knox in front of Kudu.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
