feat(configmap-reloader): introduce flag reload-authorization-header #7258
Conversation
|
Waiting for merge of thanos-io/thanos#8042 |
RouxAntoine
force-pushed
the
feature/prometheus-config-reloader-authenticated
branch
from
bf58206 to
0cf5ef6
Compare
|
After discussion and recommandation on the thanos pull request thanos-io/thanos#8042 (comment) I change my first try to a new meaning with round tripper. |
RouxAntoine
force-pushed
the
feature/prometheus-config-reloader-authenticated
branch
2 times, most recently
from
403702a to
de2a844
Compare
| @@ -105,6 +106,9 @@ func main() { | |||
| reloadURL := app.Flag("reload-url", "URL to trigger the configuration"). | |||
| Default("http://127.0.0.1:9090/-/reload").URL() | |||
|
|
|||
| reloadBasicUsername := app.Flag("reload-basic-username", "basic username passed as Authorization Header with Basic auth schema").Default("").String() | |||
| reloadBasicPassword := app.Flag("reload-basic-password", "basic password passed as Authorization Header with Basic auth schema").Default("").String() | |||
There was a problem hiding this comment.
password should be read from a file.
There was a problem hiding this comment.
In my case I don't need it (because I pass flag with helm chart and terraform secret in extraArgs https://github.com/prometheus-community/helm-charts/blob/main/charts/prometheus/values.yaml#L75).
Does there is a security problem behind this constraint ?
In case I would use a file (with extraConfigmapMounts or extraVolumeMounts) does something like a plain file path containing a user:password is sufficient or a more advanced json for exemple with
{
"user": "",
"password": ""
}
?
|
After my pull request I find out this one |
|
#7004 fell through the cracks of my review backlog but yes it would accomplish the same thing and is already in good shape. |
|
Do you have some EAT for merge of #7004 please ? |
… pass username and password for basic authentication use during call to prometheus reload endpoint Signed-off-by: RouxAntoine <[email protected]>
RouxAntoine
force-pushed
the
feature/prometheus-config-reloader-authenticated
branch
from
b109b33 to
7fb8913
Compare
Introduce flag in the configmap reloader to pass username and password for basic authentication to call prometheus reload endpoint.
Description
The purpose is to support a secured prometheus with basic auth.
As far as I know this solve the issues #5836 and #2358 .
Type of change
What type of changes does your code introduce to the Prometheus operator? Put an
xin the box that apply.CHANGE(fix or feature that would cause existing functionality to not work as expected)FEATURE(non-breaking change which adds functionality)BUGFIX(non-breaking change which fixes an issue)ENHANCEMENT(non-breaking change which improves existing functionality)NONE(if none of the other choices apply. Example, tooling, build system, CI, docs, etc.)Verification
Please check the Prometheus-Operator testing guidelines for recommendations about automated tests.
Changelog entry
Please put a one-line changelog entry below. This will be copied to the changelog file during the release process.