Marton Greber has submitted this change and it was merged. (
http://gerrit.cloudera.org:8080/24278 )
Change subject: KUDU-3693: Add bearer token auth for Prometheus
......................................................................
KUDU-3693: Add bearer token auth for Prometheus
Prometheus does not support SPNEGO, so scraping a secured Kudu cluster
requires an alternative authentication mechanism. Add
--webserver_prometheus_token_cmd: when set, designated Prometheus
endpoints (/metrics_prometheus, /prometheus-sd) accept an
"Authorization: Bearer <token>" header as an alternative to SPNEGO.
This allows Prometheus scrapers to authenticate on an otherwise
SPNEGO-secured cluster. Clients that do support SPNEGO (e.g.
curl --negotiate, Knox Gateway) can continue to use it on these
endpoints as before.
Adds unit tests in webserver-test.cc and integration tests in
prometheus_auth-itest.cc covering correct, wrong, and missing
token scenarios for both scrape and SD endpoints.
Example Prometheus configs for using the Bearer token:
Static scrape config:
global:
scrape_configs:
- job_name: kudu
metrics_path: /metrics_prometheus
scrape_interval: 2s
authorization:
type: Bearer
credentials: <webserver_prometheus_token>
static_configs:
- targets:
- 127.0.0.1:8050
- 127.0.0.1:8051
- 127.0.0.1:8052
SD scrape config:
global:
scrape_configs:
- job_name: kudu
metrics_path: /metrics_prometheus
scrape_interval: 2s
authorization:
type: Bearer
credentials: <webserver_prometheus_token>
http_sd_configs:
- url: http://127.0.0.1:8050/prometheus-sd
refresh_interval: 2s
authorization:
type: Bearer
credentials: <webserver_prometheus_token>
- url: http://127.0.0.1:8051/prometheus-sd
refresh_interval: 2s
authorization:
type: Bearer
credentials: <webserver_prometheus_token>
- url: http://127.0.0.1:8052/prometheus-sd
refresh_interval: 2s
authorization:
type: Bearer
credentials: <webserver_prometheus_token>
Change-Id: If8169196a2c49d64865095f3bc6da1d3bfbcecfb
Reviewed-on: http://gerrit.cloudera.org:8080/24278
Tested-by: Marton Greber <[email protected]>
Reviewed-by: Zoltan Chovan <[email protected]>
Reviewed-by: Gabriella Lotz <[email protected]>
---
M src/kudu/integration-tests/CMakeLists.txt
A src/kudu/integration-tests/prometheus_auth-itest.cc
M src/kudu/master/master_path_handlers.cc
M src/kudu/server/default_path_handlers.cc
M src/kudu/server/webserver-test.cc
M src/kudu/server/webserver.cc
M src/kudu/server/webserver.h
M src/kudu/server/webserver_options.cc
M src/kudu/server/webserver_options.h
M src/kudu/util/mini_prometheus.cc
M src/kudu/util/mini_prometheus.h
11 files changed, 688 insertions(+), 49 deletions(-)
Approvals:
Marton Greber: Verified
Zoltan Chovan: Looks good to me, approved
Gabriella Lotz: Looks good to me, but someone else must approve
--
To view, visit http://gerrit.cloudera.org:8080/24278
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: merged
Gerrit-Change-Id: If8169196a2c49d64865095f3bc6da1d3bfbcecfb
Gerrit-Change-Number: 24278
Gerrit-PatchSet: 7
Gerrit-Owner: Marton Greber <[email protected]>
Gerrit-Reviewer: Alexey Serbin <[email protected]>
Gerrit-Reviewer: Gabriella Lotz <[email protected]>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <[email protected]>
Gerrit-Reviewer: Zoltan Chovan <[email protected]>
Gerrit-Reviewer: Zoltan Martonka <[email protected]>
