PMM-10714 postgres-exporter auth (#1218)

PMM-10714 postgres_exporter webconfig

(cherry picked from commit 46a8f00)

managed/services/agents/postgresql.go

@@ -30,11 +30,12 @@ import (
 )
 
 var postgresExporterAutodiscoveryVersion = version.MustParse("2.15.99")
+var postgresExporterWebConfigVersion = version.MustParse("2.30.99")
 
 // postgresExporterConfig returns desired configuration of postgres_exporter process.
 func postgresExporterConfig(service *models.Service, exporter *models.Agent, redactMode redactMode,
 	pmmAgentVersion *version.Parsed,
-) *agentpb.SetStateRequest_AgentProcess {
+) (*agentpb.SetStateRequest_AgentProcess, error) {
 	if service.DatabaseName == "" {
 		panic("database name not set")
 	}
@@ -85,14 +86,19 @@ func postgresExporterConfig(service *models.Service, exporter *models.Agent, red
 		Args:               args,
 		Env: []string{
 			fmt.Sprintf("DATA_SOURCE_NAME=%s", exporter.DSN(service, timeout, service.DatabaseName, nil)),
-			fmt.Sprintf("HTTP_AUTH=pmm:%s", exporter.GetAgentPassword()),
 		},
 		TextFiles: exporter.Files(),
 	}
+
 	if redactMode != exposeSecrets {
 		res.RedactWords = redactWords(exporter)
 	}
-	return res
+
+	if err := ensureAuthParams(exporter, res, pmmAgentVersion, postgresExporterWebConfigVersion); err != nil {
+		return nil, err
+	}
+
+	return res, nil
 }
 
 // qanPostgreSQLPgStatementsAgentConfig returns desired configuration of qan-mongodb-profiler-agent built-in agent.

managed/services/agents/postgresql_test.go

@@ -72,7 +72,8 @@ func (s *PostgresExporterConfigTestSuite) SetupTest() {
 }
 
 func (s *PostgresExporterConfigTestSuite) TestConfig() {
-	actual := postgresExporterConfig(s.postgresql, s.exporter, redactSecrets, s.pmmAgentVersion)
+	actual, err := postgresExporterConfig(s.postgresql, s.exporter, redactSecrets, s.pmmAgentVersion)
+	s.NoError(err, "Failed to create exporter config")
 
 	requireNoDuplicateFlags(s.T(), actual.Args)
 	s.Require().Equal(s.expected.Args, actual.Args)
@@ -85,7 +86,8 @@ func (s *PostgresExporterConfigTestSuite) TestDatabaseName() {
 		s.postgresql.DatabaseName = "db1"
 		s.expected.Env[0] = "DATA_SOURCE_NAME=postgres://username:s3cur3%20p%[email protected]:5432/db1?connect_timeout=1&sslmode=disable"
 
-		actual := postgresExporterConfig(s.postgresql, s.exporter, redactSecrets, s.pmmAgentVersion)
+		actual, err := postgresExporterConfig(s.postgresql, s.exporter, redactSecrets, s.pmmAgentVersion)
+		s.NoError(err, "Failed to create exporter config")
 
 		s.Require().Equal(s.expected.Env, actual.Env)
 	})
@@ -94,23 +96,26 @@ func (s *PostgresExporterConfigTestSuite) TestDatabaseName() {
 		s.postgresql.DatabaseName = ""
 
 		s.Require().PanicsWithValue("database name not set", func() {
-			postgresExporterConfig(s.postgresql, s.exporter, redactSecrets, s.pmmAgentVersion)
+			_, err := postgresExporterConfig(s.postgresql, s.exporter, redactSecrets, s.pmmAgentVersion)
+			s.NoError(err, "Failed to create exporter config")
 		})
 	})
 }
 
 func (s *PostgresExporterConfigTestSuite) TestEmptyPassword() {
 	s.exporter.Password = nil
 
-	actual := postgresExporterConfig(s.postgresql, s.exporter, exposeSecrets, s.pmmAgentVersion)
+	actual, err := postgresExporterConfig(s.postgresql, s.exporter, exposeSecrets, s.pmmAgentVersion)
+	s.NoError(err, "Failed to create exporter config")
 
 	s.Assert().Equal("DATA_SOURCE_NAME=postgres://[email protected]:5432/postgres?connect_timeout=1&sslmode=disable", actual.Env[0])
 }
 
 func (s *PostgresExporterConfigTestSuite) TestEmptyUsername() {
 	s.exporter.Username = nil
 
-	actual := postgresExporterConfig(s.postgresql, s.exporter, exposeSecrets, s.pmmAgentVersion)
+	actual, err := postgresExporterConfig(s.postgresql, s.exporter, exposeSecrets, s.pmmAgentVersion)
+	s.NoError(err, "Failed to create exporter config")
 
 	s.Assert().Equal("DATA_SOURCE_NAME=postgres://:s3cur3%20p%[email protected]:5432/postgres?connect_timeout=1&sslmode=disable", actual.Env[0])
 }
@@ -119,7 +124,8 @@ func (s *PostgresExporterConfigTestSuite) TestEmptyUsernameAndPassword() {
 	s.exporter.Username = nil
 	s.exporter.Password = nil
 
-	actual := postgresExporterConfig(s.postgresql, s.exporter, exposeSecrets, s.pmmAgentVersion)
+	actual, err := postgresExporterConfig(s.postgresql, s.exporter, exposeSecrets, s.pmmAgentVersion)
+	s.NoError(err, "Failed to create exporter config")
 
 	s.Assert().Equal("DATA_SOURCE_NAME=postgres://1.2.3.4:5432/postgres?connect_timeout=1&sslmode=disable", actual.Env[0])
 }
@@ -131,7 +137,8 @@ func (s *PostgresExporterConfigTestSuite) TestSocket() {
 	s.postgresql.Port = nil
 	s.postgresql.Socket = pointer.ToString("/var/run/postgres")
 
-	actual := postgresExporterConfig(s.postgresql, s.exporter, exposeSecrets, s.pmmAgentVersion)
+	actual, err := postgresExporterConfig(s.postgresql, s.exporter, exposeSecrets, s.pmmAgentVersion)
+	s.NoError(err, "Failed to create exporter config")
 
 	s.Assert().Equal("DATA_SOURCE_NAME=postgres:///postgres?connect_timeout=1&host=%2Fvar%2Frun%2Fpostgres&sslmode=disable", actual.Env[0])
 }
@@ -143,7 +150,8 @@ func (s *PostgresExporterConfigTestSuite) TestDisabledCollectors() {
 	s.postgresql.Socket = pointer.ToString("/var/run/postgres")
 	s.exporter.DisabledCollectors = []string{"custom_query.hr", "custom_query.hr.directory"}
 
-	actual := postgresExporterConfig(s.postgresql, s.exporter, exposeSecrets, s.pmmAgentVersion)
+	actual, err := postgresExporterConfig(s.postgresql, s.exporter, exposeSecrets, s.pmmAgentVersion)
+	s.NoError(err, "Failed to create exporter config")
 
 	expected := &agentpb.SetStateRequest_AgentProcess{
 		Type:               inventorypb.AgentType_POSTGRES_EXPORTER,
@@ -176,7 +184,8 @@ func (s *PostgresExporterConfigTestSuite) TestAutoDiscovery() {
 		Password:  pointer.ToString("s3cur3 p@$$w0r4."),
 	}
 
-	actual := postgresExporterConfig(s.postgresql, s.exporter, redactSecrets, s.pmmAgentVersion)
+	actual, err := postgresExporterConfig(s.postgresql, s.exporter, redactSecrets, s.pmmAgentVersion)
+	s.NoError(err, "Failed to create exporter config")
 
 	s.expected = &agentpb.SetStateRequest_AgentProcess{
 		Type:               inventorypb.AgentType_POSTGRES_EXPORTER,
@@ -227,7 +236,8 @@ func (s *PostgresExporterConfigTestSuite) TestAzureTimeout() {
 		},
 	}
 
-	actual := postgresExporterConfig(s.postgresql, s.exporter, redactSecrets, s.pmmAgentVersion)
+	actual, err := postgresExporterConfig(s.postgresql, s.exporter, redactSecrets, s.pmmAgentVersion)
+	s.NoError(err, "Failed to create exporter config")
 
 	s.expected = &agentpb.SetStateRequest_AgentProcess{
 		Type:               inventorypb.AgentType_POSTGRES_EXPORTER,

managed/services/agents/state.go

@@ -235,7 +235,11 @@ func (u *StateUpdater) sendSetStateRequest(ctx context.Context, agent *pmmAgentI
 				}
 				agentProcesses[row.AgentID] = cfg
 			case models.PostgresExporterType:
-				agentProcesses[row.AgentID] = postgresExporterConfig(service, row, redactMode, pmmAgentVersion)
+				cfg, err := postgresExporterConfig(service, row, redactMode, pmmAgentVersion)
+				if err != nil {
+					return err
+				}
+				agentProcesses[row.AgentID] = cfg
 			case models.ProxySQLExporterType:
 				agentProcesses[row.AgentID] = proxysqlExporterConfig(service, row, redactMode, pmmAgentVersion)
 			case models.QANMySQLPerfSchemaAgentType: