PureStorage-OpenConnect / pure-fa-openmetrics-exporter

Pure Storage OpenMetrics exporter for FlashArray
Apache License 2.0
18 stars 26 forks source link

added option to set api key as get parameter #27

Closed 4xoc closed 1 year ago

4xoc commented 1 year ago

This PR reintroduces behavior from an older exporter where API keys can be supplied as GET parameter. Doing so allows using a single scrape config for multiple arrays that all use different API keys which in turn simplifies alerting rules (because job_name is identical). It removes the requirement to have one scrape config per target configured as is the case today.

WARNING using this feature will result in API keys being visible in the target list in Prometheus. Use with read-only keys only and be be aware of the security implications. This function only works when the exporter is started using a new flag -secret_parameter to enable this functionality only on purpose.

Example Prometheus config

  - job_name: pure_fa                                                                                                                                                                                                                                                             
    honor_labels: true                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              
    metrics_path: /metrics                                                                                                                                                                                                                                                        
    scrape_interval: 10s                                                                                                                                                                                                                                                          
    relabel_configs:                                                                                                                                                                                                                                                              
      - source_labels: [__address__]                                                                                                                                                                                                                                              
        target_label: __param_endpoint                                                                                                                                                                                                                                            
      - source_labels: [__pure_api_token]                                                                                                                                                                                                                                         
        target_label: __param_api_token
      - target_label: __address__
        replacement: localhost:9490
    file_sd_configs:
      - files:
        - /etc/prometheus/targets/pure.yml

Example file_sd contents:

- targets: [ pure01.foo.com ]
  labels:
    __pure_api_token: 1234
- targets: [ pure02.foo.com ]
  labels:
    __pure_api_token: 5678
genegr commented 1 year ago

There has been in the past a discussion on this topic and it was expressly required by the Prometheus maintainers to remove the authentication token from the get parameters, so we have to reject this PR. We will instead implement a different option, that consists of a simple configuration containing the flasharray/api-token as a list of key/value pairs.