Adding TLS to node exporter - cleaner version #1277

ksherryBAE · 2019-03-07T15:16:05Z

As discussed in #1198
TLS added in https package.
TLS enabled by config file specified by running with the flag --web.tls-config="/Path-to-Config/"
If no flags passed, http listener starts up as normal.

ksherryBAE · 2019-03-07T15:53:41Z

@brian-brazil Here's the clearer version of the TLS package

simonpasquier

Similar to prometheus/common#173, we could use tls.Config.GetConfigForClient to read the key+cert and CAs from disk every time a client connects, allowing for seamless certificate rotations.

https/tls_config.go

brian-brazil

Just a first pass. We should also have unittests for this.

https/README.md

https/tls-config.yml

https/README.md

https/tls_config.go

node_exporter.go

https/tls_config.go

node_exporter.go

mxinden

Thanks for opening up a clean pull request @ksherryBAE. I left a couple of comments.

https/tls_config.go

https/README.md

https/tls-config.yml

https/tls_config.go

node_exporter.go

https/tls_config.go

https/README.md

https/tls-config.yml

https/tls_config.go

ksherryBAE · 2019-03-29T10:18:25Z

@brian-brazil tests have now been added to 92% coverage

simonpasquier · 2019-04-02T13:22:56Z

https/testdata/server.crt

+        Issuer: C=NO, O=Green AS, OU=Green Certificate Authority, CN=Green TLS CA
+        Validity
+            Not Before: Jul 26 12:47:08 2017 GMT
+            Not After : Jul 26 12:47:08 2019 GMT


This would break us sooner than later. Please generate a certificate with a very large validity period.

This was reused from common/config/testdata , might it be worth waiting until this moves into common and then updating them both?

Certificates from common/config/testdata have been updated so you can copy them again.

simonpasquier · 2019-04-02T13:23:26Z

https/README.md

+  # Paths to Cert File & Key file from base directory
+  # Both required for valid tls
+  # Paths set as string values
+  # These are reloaded on initial connection and


simonpasquier · 2019-04-02T13:23:44Z

https/README.md

+  tlsCertPath : <filename>
+  tlsKeyPath : <filename>
+
+  # ClientAuth declares the policy the server will follow for client auth


auth -> authentication

simonpasquier · 2019-04-02T13:25:46Z

https/README.md

+  tlsKeyPath : <filename>
+
+  # ClientAuth declares the policy the server will follow for client auth
+  # Accepts the following string values and maps to ClientAuth Policies


A link to https://golang.org/pkg/crypto/tls/#ClientAuthType might be useful.

https/tls_config.go

simonpasquier · 2019-04-02T13:41:51Z

https/tls_config.go

+	TLSConfig TLSStruct `yaml:"tlsConfig"`
+}
+
+type TLSStruct struct {


https/tls_config.go

simonpasquier · 2019-04-02T13:43:24Z

https/tls_config.go

+func configToTLSConfig(c *Config) (*tls.Config, error) {
+	cfg := &tls.Config{}
+	if len(c.TLSConfig.TLSCertPath) > 0 && len(c.TLSConfig.TLSKeyPath) > 0 {
+		_, err := tls.LoadX509KeyPair(c.TLSConfig.TLSCertPath, c.TLSConfig.TLSKeyPath)


Please add a comment explaining that it is only for the initial validation of the certificate and key. You could also call cfg.GetCertificate() after initializing it to avoid code repetition:

cfg.GetCertificate = func(*tls.ClientHelloInfo) (*tls.Certificate, error) { ... } // Check that certificate and key files are valid. _, err := cfg.GetCertificate(nil) if err != nil { return nil, err }

simonpasquier · 2019-04-02T13:52:37Z

https/tls_config.go

+		case "RequireAndVerifyClientCert":
+			cfg.ClientAuth = tls.RequireAndVerifyClientCert
+		default:
+			return nil, errors.New("Invalid string provided to ClientAuth")


The erroneous value should be displayed.

https/tls_config_test.go

brian-brazil · 2019-04-03T13:00:35Z

https/testdata/tls_config_junk.yml

@@ -0,0 +1,27 @@
+I wandered lonely as a cloud


While this is well out of copyright, it'd be best to use actual junk so companies using this don't have to send lawyers to verify.

ksherryBAE · 2019-04-11T09:29:03Z

I'm afraid I can't see why the buildkite/node-exporter build is failing, could anyone offer some insight? I assume it's something to do with the tests?

SuperQ · 2019-04-11T10:56:00Z

The buildkite jobs all fail with this:

2019/04/11 http: TLS handshake error from [::1]:51818: write tcp [::1]:44783->[::1]:51818: use of closed network connection
  | panic: runtime error: invalid memory address or nil pointer dereference [recovered]
  | panic: runtime error: invalid memory address or nil pointer dereference
  | [signal SIGSEGV: segmentation violation code=0x1 addr=0x18 pc=0x1029c914]
  |  
  | goroutine 19 [running]:
  | testing.tRunner.func1(0xc000100100)
  | /home/peon/godev/go/src/testing/testing.go:830 +0x384
  | panic(0x102ef600, 0x105d0b60)
  | /home/peon/godev/go/src/runtime/panic.go:522 +0x1c8
  | github.com/prometheus/node_exporter/https.TestListen(0xc000100100)
  | /home/peon/.buildkite-agent/builds/debian-9-4-0-ppc64le-build-prometheus-io-1/prometheus/node-exporter-370675b33ffdfb96e5199ec46a69acbf2403ea6e-1703-8zdG/src/github.com/prometheus/node_exporter/https/tls_config_test.go:337 +0x1d24
  | testing.tRunner(0xc000100100, 0x103671f8)
  | /home/peon/godev/go/src/testing/testing.go:865 +0xc4
  | created by testing.(*T).Run
  | /home/peon/godev/go/src/testing/testing.go:916 +0x2f4
  | FAIL	github.com/prometheus/node_exporter/https	9.736s
  | Makefile:77: recipe for target 'test' failed
  | make: *** [test] Error 1

simonpasquier

This would also need tests validating that the certificate, key and configuration files are effectively reloaded for every request.

simonpasquier · 2019-04-15T12:44:09Z

https/testdata/tls_config_auth_clientCAs_invalid.bad.yml

@@ -0,0 +1,8 @@
+#TLS Config YAML


(nit) this line can be removed and you could also remove the blank lines. Same remark for the other test configuration files.

simonpasquier · 2019-04-15T12:49:27Z

https/tls_config_test.go

+		log.Printf("Running %v tests:", numberOfTests)
+	}
+
+	logsDisabled := func(disable bool) {


We don't usually customize the logging this way. I'd suggest to just use t.Log()/t.Logf() if needed.

simonpasquier · 2019-04-15T12:51:45Z

https/tls_config_test.go

+	var errorMessage error
+
+	var once sync.Once
+	recordConnectionResult := func(status bool, err error) {


I see that status is true only if err is nil so I think that recording and checking err alone is enough.

simonpasquier · 2019-04-15T12:52:54Z

https/tls_config_test.go

+		}
+	}
+	for _, test := range testTables {
+		test.httpClient = test.Client()


You can use T.Run here.

https/tls_config_test.go

simonpasquier · 2019-04-15T12:55:34Z

https/tls_config_test.go

+func TestListen(t *testing.T) {
+	logging := testing.Verbose()
+
+	port := ":9100"


This is still using a fixed port number.

@simonpasquier do you have any suggestions on how to use a random available port? The generally accepted method appears to be to create a Listener independently of the server, get the port with that, and then start the server with s.Serve(Listener), such as in the answer to this StackOverflow question; but due to the way the https.Listen function is being utilised this is not possible.
I have previously tried using a Listener to find an available port, releasing it from the listener and using the port again for the server, but this did not pass the build tests.

simonpasquier · 2019-04-15T12:56:27Z

https/tls_config_test.go

+			return
+		}
+		if string(body) != "Hello World!" {
+			recordConnectionResult(false, err)


You need to create a custom error here.

ksherryBAE · 2019-05-22T14:16:06Z

Hello, has there been any further thoughts on this? I know there was talk of an experimental branch, would a pull request against an experimental branch be of interest?

simonpasquier · 2019-05-23T08:18:11Z

https/README.md

+
+```
+#TLS CONFIG YAML
+  # Main config options for tls


Those 2 lines could be removed IMO.

simonpasquier · 2019-05-23T08:18:57Z

https/README.md

@@ -0,0 +1,42 @@
+# HTTPS Package for prometheus


simonpasquier · 2019-05-23T08:19:17Z

https/README.md

@@ -0,0 +1,42 @@
+# HTTPS Package for prometheus
+
+The `https` directory contains files and a template config for the implementation of tls.


simonpasquier · 2019-05-23T08:21:40Z

https/README.md

+The config file should is written in YAML format.
+The layout is outlined below, with optional parameters in brackets.
+
+For more detail on the clientAuth option: [ClientAuthType](https://golang.org/pkg/crypto/tls/#ClientAuthType)


This could be moved to the configuration file example instead.

simonpasquier · 2019-05-23T08:22:13Z

https/README.md

+  # RequireAndVerifyClientCert  
+  [ clientAuth : <string> | default = "NoClientCert" ]
+
+  # ClientCa's accepts a string path to the set of CA's


s/ClientCa's/clientCAs/

simonpasquier · 2019-05-23T08:51:46Z

https/tls_config_test.go

+	}()
+	err := <-errorChannel
+	if test.isCorrectError(err) == false {
+		t.Errorf(" *** Failed test: %s *** Returned error: %v *** Expected error: %v", test.Name, err, test.ExpectedError)


No need to add the test's name (it will already be reported by the testing package). And the error message should be clear about what is wrong (eg error expected but doesn't match vs. unexpected error):
"Expected error to match regular expression %q, got %q"
"Expected no error, got %q"

simonpasquier · 2019-05-23T08:55:15Z

https/tls_config_test.go

+	"errors"
+	"fmt"
+	"io/ioutil"
+	"log"


No need to use the log package. The code should either panic (eg getPort()) or use t.Fatal.

https/tls_config_test.go

simonpasquier · 2019-05-23T09:19:16Z

https/tls_config_test.go

+func TestServerBehaviour(t *testing.T) {
+	testTables := []*TestInputs{
+		{
+			Name:           `nil Server and default client`,


By definition, the Listen() function expects that server isn't nil so I wouldn't have this test.

node_exporter.go

jakewarr8 · 2019-06-15T00:27:00Z

any help needed on this?

simonpasquier · 2019-06-17T13:06:13Z

https/README.md

+# HTTPS Package for Prometheus
+
+The `https` directory contains files and a template config for the implementation of TLS.
+When running a server with tls use the flag `--web.tls-config`


simonpasquier · 2019-06-17T13:08:33Z

https/README.md

@@ -0,0 +1,10 @@
+# HTTPS Package for Prometheus
+
+The `https` directory contains files and a template config for the implementation of TLS.


Suggestion: "The https directory contains a Go package and a sample configuration file for running node_exporter with HTTPS instead of HTTP."

simonpasquier · 2019-06-17T13:09:54Z

https/README.md

+
+The `https` directory contains files and a template config for the implementation of TLS.
+When running a server with tls use the flag `--web.tls-config`
+Where the path is from where the exporter was run.


I wouldn't mention it since this is the usual way of doing things.

simonpasquier · 2019-06-17T13:10:34Z

https/README.md

+e.g. `./node_exporter --web.tls-config="https/tls-config.yml"`
+If the config is kept within the https directory.
+
+The config file should is written in YAML format, and is reloaded on each connection to check for new certificates and/or authentication policy.


I would include the sample configuration in this page.

simonpasquier · 2019-06-17T13:15:31Z

https/tls_config.go

+
+// When the listen function is called if the tlsConfigPath is an empty string an HTTP server is started
+// If the tlsConfigPath is a valid config file then an HTTPS server will be started
+// The listen function also sets the GetConfigForClient method of the HTTPS server so that the config and certs are reloaded on new connections


I would move this comment right before L107.

simonpasquier · 2019-06-17T13:16:53Z

https/tls_config.go

+// If the tlsConfigPath is a valid config file then an HTTPS server will be started
+// The listen function also sets the GetConfigForClient method of the HTTPS server so that the config and certs are reloaded on new connections
+func Listen(server *http.Server, tlsConfigPath string) error {
+	if len(tlsConfigPath) > 0 {


I prefer this code flow:

if len(tlsConfigPath) == 0 { return server.ListenAndServe() } ... return server.ListenAndServeTLS("", "")

simonpasquier · 2019-06-17T13:23:56Z

https/tls_config.go

+	return cfg, nil
+}
+
+// When the listen function is called if the tlsConfigPath is an empty string an HTTP server is started


Suggestion: "Listen starts the server on the given address. If tlsConfigPath isn't empty the connection will be using TLS."

https/tls_config_test.go

simonpasquier · 2019-06-17T13:44:46Z

https/tls_config.go

+		loadCert := func() (*tls.Certificate, error) {
+			cert, err := tls.LoadX509KeyPair(c.TLSCertPath, c.TLSKeyPath)
+			if err != nil {
+				return nil, err


Using errors.Wrap(...) would be interesting as otherwise it might not be obvious what is failing.

simonpasquier · 2019-06-17T13:46:17Z

https/tls_config.go

+
+func configToTLSConfig(c *TLSConfig) (*tls.Config, error) {
+	cfg := &tls.Config{}
+	if len(c.TLSCertPath) > 0 && len(c.TLSKeyPath) > 0 {


See below too but TLSCertPath and TLSKeyPath are mandatory so YAML umarshaling should have filed.

ksherryBAE · 2019-07-09T10:45:34Z

Hello, just checking on this. Any further thoughts about this pr or about possibly moving to an experimental branch?

simonpasquier · 2019-07-17T14:37:20Z

@ksherryBAE I pushed a few changes on top of the PR and resolve the latest conflicts. It looks good to me at the code level but it would need other reviews from @brian-brazil and @SuperQ.

brian-brazil · 2019-07-23T09:47:06Z

https/README.md

+The `https` directory contains a Go package and a sample configuration file for running `node_exporter` with HTTPS instead of HTTP.
+When running a server with TLS use the flag `--web.tls-config`
+
+e.g. `./node_exporter --web.tls-config="https/tls-config.yml"`


Aren't we planning on doing basic auth too? A more generic flag name would be better

https doesn't cover basic auth.

brian-brazil · 2019-07-23T09:51:34Z

https/tls_config.go

+}
+
+// Listen starts the server on the given address. If tlsConfigPath isn't empty,
+// the connection will be using TLS.


s/connection/server/

https/README.md

simonpasquier · 2019-08-22T13:07:45Z

https/README.md

+# HTTPS Package for Prometheus
+
+The `https` directory contains a Go package and a sample configuration file for running `node_exporter` with HTTPS instead of HTTP.
+When running a server with TLS use the flag `--web.authentication-config`


since eventually the file will hold configuration for both TLS and authentication, maybe we should name the flag --web.config?

simonpasquier · 2019-08-22T13:17:42Z

https/tls_config.go

+			return nil, errors.New("invalid ClientAuth: " + s)
+		}
+	}
+	if len(c.ClientCAs) > 0 && len(c.ClientAuth) == 0 {


For clarity and to match the README file, I would default c.ClientAuth to NoClientCert if unset and change this test to len(c.ClientCAs) > 0 && c.ClientAuth != NoClientCert.

Signed-off-by: KSherry <kieran.sherry@baesystems.com>

simonpasquier · 2019-10-14T12:11:58Z

@ksherryBAE you need to sync the vendor/ directory:

rm -rf vendor/*
make unused
git add vendor/ && git commit -s -m "update vendor/"

Signed-off-by: KSherry <kieran.sherry@baesystems.com>

simonpasquier · 2019-10-15T08:16:38Z

@ksherryBAE still not ok. Can you make sure you have Go 1.13.1 installed locally?

Signed-off-by: Ben RIdley <benridley29@gmail.com>

update vendor/

benridley · 2019-10-27T20:45:35Z

Anything else required on this?

PRIHLOP · 2019-11-13T08:33:11Z

Hello. Sorry for my perseverance.
This is a very important and highly anticipated feature. When can you expect a merge?

pashok2398 · 2019-11-14T09:46:17Z

@ksherryBAE Sorry for the stupid question but, is there an option to validate the client (prometheus server) based on certificate attribute and not just on the signed CA?
For me is, if i want to use trusted root CA to sign both client (prometheus) and server (exporter) certificates and make sure that authentication is made not just by the signed CA...

SuperQ · 2019-11-14T10:21:04Z

We discussed this at our dev summit. I think it's ready to go. I cleaned up most of the un-resolved and outdated comments.

Can I get one final thumbs up from @simonpasquier and @brian-brazil

simonpasquier

👍

https/tls_config.go

brian-brazil

👍

brian-brazil · 2019-11-14T11:37:43Z

https/README.md

+When running a server with TLS use the flag `--web.config`
+
+e.g. `./node_exporter --web.config="web-config.yml"`
+If the config is kept within the https directory.


Wouldn't it be https/web-config.yml then?

I'm going to merge this and we can do more work in additional MRs.

thda · 2019-11-18T06:06:54Z

Can we get an rc or an alpha release containing this?
I'd like to try out and provide feedback.
I could not find a release schedule.

SuperQ · 2019-11-18T11:15:10Z

There is no release schedule for the node_exporter. Feel free to build your own for testing.

simonpasquier · 2019-11-18T13:00:53Z

@thda you can get the binaries from here.

markmsmith · 2019-11-21T16:12:08Z

Just so I understand the above, is the plan to have a 0.19.0 release where we can get this (just not scheduled for a particular date yet), or is the next official release going to be 1.0, so we'll have to wait for all the stuff on the 1.0 project board to land?
https://github.com/prometheus/node_exporter/projects/1
(Also, the CircleCI link for the binaries gives me a 404).

SuperQ · 2019-11-21T18:11:56Z

Milestone 1.0. https://github.com/prometheus/node_exporter/milestone/5

We're pretty close, so I don't think we'll need to do 0.19, as I would want those fixed for 0.19 anyway.

WOLFinBULLcity · 2019-12-11T19:31:35Z

@SuperQ, is 1.0 still coming pretty soon? Or could a release be made to at least include the TLS support? It's currently a blocker for me being able to use node exporter. Thanks!

* The netdev collector CLI argument `--collector.netdev.ignored-devices` was renamed to `--collector.netdev.device-blacklist` in order to conform with the systemd collector. #1279 * The label named `state` on `node_systemd_service_restart_total` metrics was changed to `name` to better describe the metric. #1393 * Refactoring of the mdadm collector changes several metrics - `node_md_disks_active` is removed - `node_md_disks` now has a `state` label for "fail", "spare", "active" disks. - `node_md_is_active` is replaced by `node_md_state` with a state set of "active", "inactive", "recovering", "resync". * Additional label `mountaddr` added to NFS device metrics to distinguish mounts from the same URL, but different IP addresses. #1417 * Metrics node_cpu_scaling_frequency_min_hrts and node_cpu_scaling_frequency_max_hrts of the cpufreq collector were renamed to node_cpu_scaling_frequency_min_hertz and node_cpu_scaling_frequency_max_hertz. #1510 * Collectors that are enabled, but are unable to find data to collect, now return 0 for `node_scrape_collector_success`. * [CHANGE] Add `--collector.netdev.device-whitelist`. #1279 * [CHANGE] Ignore iso9600 filesystem on Linux #1355 * [CHANGE] Refactor mdadm collector #1403 * [CHANGE] Add `mountaddr` label to NFS metrics. #1417 * [CHANGE] Don't count empty collectors as success. #1613 * [FEATURE] New flag to disable default collectors #1276 * [FEATURE] Add experimental TLS support #1277, #1687, #1695 * [FEATURE] Add collector for Power Supply Class #1280 * [FEATURE] Add new schedstat collector #1389 * [FEATURE] Add FreeBSD zfs support #1394 * [FEATURE] Add uname support for Darwin and OpenBSD #1433 * [FEATURE] Add new metric node_cpu_info #1489 * [FEATURE] Add new thermal_zone collector #1425 * [FEATURE] Add new cooling_device metrics to thermal zone collector #1445 * [FEATURE] Add swap usage on darwin #1508 * [FEATURE] Add Btrfs collector #1512 * [FEATURE] Add RAPL collector #1523 * [FEATURE] Add new softnet collector #1576 * [FEATURE] Add new udp_queues collector #1503 * [FEATURE] Add basic authentication #1673 * [ENHANCEMENT] Log pid when there is a problem reading the process stats #1341 * [ENHANCEMENT] Collect InfiniBand port state and physical state #1357 * [ENHANCEMENT] Include additional XFS runtime statistics. #1423 * [ENHANCEMENT] Report non-fatal collection errors in the exporter metric. #1439 * [ENHANCEMENT] Expose IPVS firewall mark as a label #1455 * [ENHANCEMENT] Add check for systemd version before attempting to query certain metrics. #1413 * [ENHANCEMENT] Add a flag to adjust mount timeout #1486 * [ENHANCEMENT] Add new counters for flush requests in Linux 5.5 #1548 * [ENHANCEMENT] Add metrics and tests for UDP receive and send buffer errors #1534 * [ENHANCEMENT] The sockstat collector now exposes IPv6 statistics in addition to the existing IPv4 support. #1552 * [ENHANCEMENT] Add infiniband info metric #1563 * [ENHANCEMENT] Add unix socket support for supervisord collector #1592 * [ENHANCEMENT] Implement loadavg on all BSDs without cgo #1584 * [ENHANCEMENT] Add model_name and stepping to node_cpu_info metric #1617 * [ENHANCEMENT] Add `--collector.perf.cpus` to allow setting the CPU list for perf stats. #1561 * [ENHANCEMENT] Add metrics for IO errors and retires on Darwin. #1636 * [ENHANCEMENT] Add perf tracepoint collection flag #1664 * [ENHANCEMENT] ZFS: read contents of objset file #1632 * [ENHANCEMENT] Linux CPU: Cache CPU metrics to make them monotonically increasing #1711 * [BUGFIX] Read /proc/net files with a single read syscall #1380 * [BUGFIX] Renamed label `state` to `name` on `node_systemd_service_restart_total`. #1393 * [BUGFIX] Fix netdev nil reference on Darwin #1414 * [BUGFIX] Strip path.rootfs from mountpoint labels #1421 * [BUGFIX] Fix seconds reported by schedstat #1426 * [BUGFIX] Fix empty string in path.rootfs #1464 * [BUGFIX] Fix typo in cpufreq metric names #1510 * [BUGFIX] Read /proc/stat in one syscall #1538 * [BUGFIX] Fix OpenBSD cache memory information #1542 * [BUGFIX] Refactor textfile collector to avoid looping defer #1549 * [BUGFIX] Fix network speed math #1580 * [BUGFIX] collector/systemd: use regexp to extract systemd version #1647 * [BUGFIX] Fix initialization in perf collector when using multiple CPUs #1665 * [BUGFIX] Fix accidentally empty lines in meminfo_linux #1671 Signed-off-by: Ben Kochie <superq@gmail.com>

Add support for https connections. Signed-off-by: ksherryBAE <kieran.sherry@baesystems.com> Signed-off-by: James Ritchie <james.g.ritchie@baesystems.com> Signed-off-by: Simon Pasquier <spasquie@redhat.com> Signed-off-by: Ben RIdley <benridley29@gmail.com>

* The netdev collector CLI argument `--collector.netdev.ignored-devices` was renamed to `--collector.netdev.device-blacklist` in order to conform with the systemd collector. prometheus#1279 * The label named `state` on `node_systemd_service_restart_total` metrics was changed to `name` to better describe the metric. prometheus#1393 * Refactoring of the mdadm collector changes several metrics - `node_md_disks_active` is removed - `node_md_disks` now has a `state` label for "fail", "spare", "active" disks. - `node_md_is_active` is replaced by `node_md_state` with a state set of "active", "inactive", "recovering", "resync". * Additional label `mountaddr` added to NFS device metrics to distinguish mounts from the same URL, but different IP addresses. prometheus#1417 * Metrics node_cpu_scaling_frequency_min_hrts and node_cpu_scaling_frequency_max_hrts of the cpufreq collector were renamed to node_cpu_scaling_frequency_min_hertz and node_cpu_scaling_frequency_max_hertz. prometheus#1510 * Collectors that are enabled, but are unable to find data to collect, now return 0 for `node_scrape_collector_success`. * [CHANGE] Add `--collector.netdev.device-whitelist`. prometheus#1279 * [CHANGE] Ignore iso9600 filesystem on Linux prometheus#1355 * [CHANGE] Refactor mdadm collector prometheus#1403 * [CHANGE] Add `mountaddr` label to NFS metrics. prometheus#1417 * [CHANGE] Don't count empty collectors as success. prometheus#1613 * [FEATURE] New flag to disable default collectors prometheus#1276 * [FEATURE] Add experimental TLS support prometheus#1277, prometheus#1687, prometheus#1695 * [FEATURE] Add collector for Power Supply Class prometheus#1280 * [FEATURE] Add new schedstat collector prometheus#1389 * [FEATURE] Add FreeBSD zfs support prometheus#1394 * [FEATURE] Add uname support for Darwin and OpenBSD prometheus#1433 * [FEATURE] Add new metric node_cpu_info prometheus#1489 * [FEATURE] Add new thermal_zone collector prometheus#1425 * [FEATURE] Add new cooling_device metrics to thermal zone collector prometheus#1445 * [FEATURE] Add swap usage on darwin prometheus#1508 * [FEATURE] Add Btrfs collector prometheus#1512 * [FEATURE] Add RAPL collector prometheus#1523 * [FEATURE] Add new softnet collector prometheus#1576 * [FEATURE] Add new udp_queues collector prometheus#1503 * [FEATURE] Add basic authentication prometheus#1673 * [ENHANCEMENT] Log pid when there is a problem reading the process stats prometheus#1341 * [ENHANCEMENT] Collect InfiniBand port state and physical state prometheus#1357 * [ENHANCEMENT] Include additional XFS runtime statistics. prometheus#1423 * [ENHANCEMENT] Report non-fatal collection errors in the exporter metric. prometheus#1439 * [ENHANCEMENT] Expose IPVS firewall mark as a label prometheus#1455 * [ENHANCEMENT] Add check for systemd version before attempting to query certain metrics. prometheus#1413 * [ENHANCEMENT] Add a flag to adjust mount timeout prometheus#1486 * [ENHANCEMENT] Add new counters for flush requests in Linux 5.5 prometheus#1548 * [ENHANCEMENT] Add metrics and tests for UDP receive and send buffer errors prometheus#1534 * [ENHANCEMENT] The sockstat collector now exposes IPv6 statistics in addition to the existing IPv4 support. prometheus#1552 * [ENHANCEMENT] Add infiniband info metric prometheus#1563 * [ENHANCEMENT] Add unix socket support for supervisord collector prometheus#1592 * [ENHANCEMENT] Implement loadavg on all BSDs without cgo prometheus#1584 * [ENHANCEMENT] Add model_name and stepping to node_cpu_info metric prometheus#1617 * [ENHANCEMENT] Add `--collector.perf.cpus` to allow setting the CPU list for perf stats. prometheus#1561 * [ENHANCEMENT] Add metrics for IO errors and retires on Darwin. prometheus#1636 * [ENHANCEMENT] Add perf tracepoint collection flag prometheus#1664 * [ENHANCEMENT] ZFS: read contents of objset file prometheus#1632 * [ENHANCEMENT] Linux CPU: Cache CPU metrics to make them monotonically increasing prometheus#1711 * [BUGFIX] Read /proc/net files with a single read syscall prometheus#1380 * [BUGFIX] Renamed label `state` to `name` on `node_systemd_service_restart_total`. prometheus#1393 * [BUGFIX] Fix netdev nil reference on Darwin prometheus#1414 * [BUGFIX] Strip path.rootfs from mountpoint labels prometheus#1421 * [BUGFIX] Fix seconds reported by schedstat prometheus#1426 * [BUGFIX] Fix empty string in path.rootfs prometheus#1464 * [BUGFIX] Fix typo in cpufreq metric names prometheus#1510 * [BUGFIX] Read /proc/stat in one syscall prometheus#1538 * [BUGFIX] Fix OpenBSD cache memory information prometheus#1542 * [BUGFIX] Refactor textfile collector to avoid looping defer prometheus#1549 * [BUGFIX] Fix network speed math prometheus#1580 * [BUGFIX] collector/systemd: use regexp to extract systemd version prometheus#1647 * [BUGFIX] Fix initialization in perf collector when using multiple CPUs prometheus#1665 * [BUGFIX] Fix accidentally empty lines in meminfo_linux prometheus#1671 Signed-off-by: Ben Kochie <superq@gmail.com>

Add support for https connections. Signed-off-by: ksherryBAE <kieran.sherry@baesystems.com> Signed-off-by: James Ritchie <james.g.ritchie@baesystems.com> Signed-off-by: Simon Pasquier <spasquie@redhat.com> Signed-off-by: Ben RIdley <benridley29@gmail.com>

* The netdev collector CLI argument `--collector.netdev.ignored-devices` was renamed to `--collector.netdev.device-blacklist` in order to conform with the systemd collector. prometheus#1279 * The label named `state` on `node_systemd_service_restart_total` metrics was changed to `name` to better describe the metric. prometheus#1393 * Refactoring of the mdadm collector changes several metrics - `node_md_disks_active` is removed - `node_md_disks` now has a `state` label for "fail", "spare", "active" disks. - `node_md_is_active` is replaced by `node_md_state` with a state set of "active", "inactive", "recovering", "resync". * Additional label `mountaddr` added to NFS device metrics to distinguish mounts from the same URL, but different IP addresses. prometheus#1417 * Metrics node_cpu_scaling_frequency_min_hrts and node_cpu_scaling_frequency_max_hrts of the cpufreq collector were renamed to node_cpu_scaling_frequency_min_hertz and node_cpu_scaling_frequency_max_hertz. prometheus#1510 * Collectors that are enabled, but are unable to find data to collect, now return 0 for `node_scrape_collector_success`. * [CHANGE] Add `--collector.netdev.device-whitelist`. prometheus#1279 * [CHANGE] Ignore iso9600 filesystem on Linux prometheus#1355 * [CHANGE] Refactor mdadm collector prometheus#1403 * [CHANGE] Add `mountaddr` label to NFS metrics. prometheus#1417 * [CHANGE] Don't count empty collectors as success. prometheus#1613 * [FEATURE] New flag to disable default collectors prometheus#1276 * [FEATURE] Add experimental TLS support prometheus#1277, prometheus#1687, prometheus#1695 * [FEATURE] Add collector for Power Supply Class prometheus#1280 * [FEATURE] Add new schedstat collector prometheus#1389 * [FEATURE] Add FreeBSD zfs support prometheus#1394 * [FEATURE] Add uname support for Darwin and OpenBSD prometheus#1433 * [FEATURE] Add new metric node_cpu_info prometheus#1489 * [FEATURE] Add new thermal_zone collector prometheus#1425 * [FEATURE] Add new cooling_device metrics to thermal zone collector prometheus#1445 * [FEATURE] Add swap usage on darwin prometheus#1508 * [FEATURE] Add Btrfs collector prometheus#1512 * [FEATURE] Add RAPL collector prometheus#1523 * [FEATURE] Add new softnet collector prometheus#1576 * [FEATURE] Add new udp_queues collector prometheus#1503 * [FEATURE] Add basic authentication prometheus#1673 * [ENHANCEMENT] Log pid when there is a problem reading the process stats prometheus#1341 * [ENHANCEMENT] Collect InfiniBand port state and physical state prometheus#1357 * [ENHANCEMENT] Include additional XFS runtime statistics. prometheus#1423 * [ENHANCEMENT] Report non-fatal collection errors in the exporter metric. prometheus#1439 * [ENHANCEMENT] Expose IPVS firewall mark as a label prometheus#1455 * [ENHANCEMENT] Add check for systemd version before attempting to query certain metrics. prometheus#1413 * [ENHANCEMENT] Add a flag to adjust mount timeout prometheus#1486 * [ENHANCEMENT] Add new counters for flush requests in Linux 5.5 prometheus#1548 * [ENHANCEMENT] Add metrics and tests for UDP receive and send buffer errors prometheus#1534 * [ENHANCEMENT] The sockstat collector now exposes IPv6 statistics in addition to the existing IPv4 support. prometheus#1552 * [ENHANCEMENT] Add infiniband info metric prometheus#1563 * [ENHANCEMENT] Add unix socket support for supervisord collector prometheus#1592 * [ENHANCEMENT] Implement loadavg on all BSDs without cgo prometheus#1584 * [ENHANCEMENT] Add model_name and stepping to node_cpu_info metric prometheus#1617 * [ENHANCEMENT] Add `--collector.perf.cpus` to allow setting the CPU list for perf stats. prometheus#1561 * [ENHANCEMENT] Add metrics for IO errors and retires on Darwin. prometheus#1636 * [ENHANCEMENT] Add perf tracepoint collection flag prometheus#1664 * [ENHANCEMENT] ZFS: read contents of objset file prometheus#1632 * [ENHANCEMENT] Linux CPU: Cache CPU metrics to make them monotonically increasing prometheus#1711 * [BUGFIX] Read /proc/net files with a single read syscall prometheus#1380 * [BUGFIX] Renamed label `state` to `name` on `node_systemd_service_restart_total`. prometheus#1393 * [BUGFIX] Fix netdev nil reference on Darwin prometheus#1414 * [BUGFIX] Strip path.rootfs from mountpoint labels prometheus#1421 * [BUGFIX] Fix seconds reported by schedstat prometheus#1426 * [BUGFIX] Fix empty string in path.rootfs prometheus#1464 * [BUGFIX] Fix typo in cpufreq metric names prometheus#1510 * [BUGFIX] Read /proc/stat in one syscall prometheus#1538 * [BUGFIX] Fix OpenBSD cache memory information prometheus#1542 * [BUGFIX] Refactor textfile collector to avoid looping defer prometheus#1549 * [BUGFIX] Fix network speed math prometheus#1580 * [BUGFIX] collector/systemd: use regexp to extract systemd version prometheus#1647 * [BUGFIX] Fix initialization in perf collector when using multiple CPUs prometheus#1665 * [BUGFIX] Fix accidentally empty lines in meminfo_linux prometheus#1671 Signed-off-by: Ben Kochie <superq@gmail.com>

simonpasquier self-requested a review March 7, 2019 16:09

simonpasquier reviewed Mar 7, 2019

View reviewed changes

https/tls_config.go Outdated Show resolved Hide resolved

https/tls_config.go Outdated Show resolved Hide resolved

https/tls_config.go Outdated Show resolved Hide resolved

simonpasquier requested a review from mxinden March 7, 2019 16:38

brian-brazil mentioned this pull request Mar 7, 2019

Adding TLS to node exporter. Server Auth only. #1198

Closed

brian-brazil reviewed Mar 7, 2019

View reviewed changes

mxinden reviewed Mar 11, 2019

View reviewed changes

brian-brazil reviewed Mar 12, 2019

View reviewed changes

brian-brazil reviewed Mar 14, 2019

View reviewed changes

https/README.md Outdated Show resolved Hide resolved

https/README.md Outdated Show resolved Hide resolved

https/README.md Outdated Show resolved Hide resolved

https/README.md Outdated Show resolved Hide resolved

https/tls-config.yml Outdated Show resolved Hide resolved

simonpasquier reviewed Mar 15, 2019

View reviewed changes

https/tls_config.go Outdated Show resolved Hide resolved

https/tls_config.go Outdated Show resolved Hide resolved

https/tls_config.go Outdated Show resolved Hide resolved

hoffie mentioned this pull request Mar 16, 2019

Node Exporter TLS/SSL support #1286

Closed

beorn7 mentioned this pull request Mar 18, 2019

prometheus/promhttp: scrape authentication prometheus/client_golang#550

Closed

mxinden mentioned this pull request Apr 1, 2019

[WIP] cluster: Secure cluster traffic via mutual TLS prometheus/alertmanager#1819

Closed

simonpasquier reviewed Apr 2, 2019

View reviewed changes

simonpasquier self-requested a review April 3, 2019 11:53

brian-brazil reviewed Apr 3, 2019

View reviewed changes

brian-brazil mentioned this pull request Apr 9, 2019

SSL and auth for Prometheus API prometheus/docs#1329

Closed

simonpasquier reviewed Apr 15, 2019

View reviewed changes

simonpasquier reviewed May 23, 2019

View reviewed changes

simonpasquier reviewed Jun 17, 2019

View reviewed changes

brian-brazil reviewed Jul 23, 2019

View reviewed changes

simonpasquier reviewed Aug 22, 2019

View reviewed changes

discordianfish added this to the v1.0.0 milestone Aug 28, 2019

ksherryBAE added 2 commits October 11, 2019 13:17

TLSConfig to TLSStruct in function call to fix rebase error

9dbf519

Signed-off-by: KSherry <kieran.sherry@baesystems.com>

go.sum fix merge error

efad30b

Signed-off-by: KSherry <kieran.sherry@baesystems.com>

update vendor/

a0f0b94

Signed-off-by: KSherry <kieran.sherry@baesystems.com>

benridley and others added 2 commits October 20, 2019 12:34

update vendor/

47d0e62

Signed-off-by: Ben RIdley <benridley29@gmail.com>

Merge pull request #2 from benridley/tls-server-auth-cleanup

f2d6f10

update vendor/

simonpasquier reviewed Nov 14, 2019

View reviewed changes

https/tls_config.go Show resolved Hide resolved

brian-brazil reviewed Nov 14, 2019

View reviewed changes

SuperQ merged commit aede041 into prometheus:master Nov 15, 2019

gouthamve mentioned this pull request Apr 16, 2020

Add TLS support to HTTP Server weaveworks/common#185

Merged

SuperQ mentioned this pull request May 25, 2020

Release 1.0.0 #1714

Merged

RenaudWasTaken mentioned this pull request Jun 3, 2020

TLS Support NVIDIA/gpu-monitoring-tools#80

Open

mxinden mentioned this pull request Oct 9, 2020

Securing the gossip protocol? prometheus/alertmanager#1322

Closed

jsturtevant mentioned this pull request Nov 5, 2021

TLS is disabled for node_exporter prometheus-operator/kube-prometheus#1486

Open

		@@ -0,0 +1,42 @@
		# HTTPS Package for prometheus

		The `https` directory contains files and a template config for the implementation of tls.

		@@ -0,0 +1,10 @@
		# HTTPS Package for Prometheus

		The `https` directory contains files and a template config for the implementation of TLS.

Adding TLS to node exporter - cleaner version #1277

Adding TLS to node exporter - cleaner version #1277

Conversation

ksherryBAE commented Mar 7, 2019

ksherryBAE commented Mar 7, 2019

simonpasquier left a comment

Choose a reason for hiding this comment

brian-brazil left a comment

Choose a reason for hiding this comment

mxinden left a comment

Choose a reason for hiding this comment

ksherryBAE commented Mar 29, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ksherryBAE commented Apr 11, 2019

SuperQ commented Apr 11, 2019

simonpasquier left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ksherryBAE commented May 22, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jakewarr8 commented Jun 15, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ksherryBAE commented Jul 9, 2019

simonpasquier commented Jul 17, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

simonpasquier commented Oct 14, 2019

simonpasquier commented Oct 15, 2019

benridley commented Oct 27, 2019

PRIHLOP commented Nov 13, 2019

pashok2398 commented Nov 14, 2019 • edited Loading

SuperQ commented Nov 14, 2019

simonpasquier left a comment

Choose a reason for hiding this comment

brian-brazil left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

thda commented Nov 18, 2019

SuperQ commented Nov 18, 2019

simonpasquier commented Nov 18, 2019

markmsmith commented Nov 21, 2019

SuperQ commented Nov 21, 2019

WOLFinBULLcity commented Dec 11, 2019

pashok2398 commented Nov 14, 2019 •

edited

Loading