jmx and jmx-exporter configuration and authentification

[giem-git]

Configuration cleanup

In TDP, the jmx-exporter is configured as a javaagent (which is the recommended way) and communicates localy with the jmx (see jmx documentation here)

As such, only one option is needed for the jvm : -Dcom.sun.management.jmxremote. All other options are unneeded and should be deleted. These options are :

• -Dcom.sun.management.jmxremote.authenticate
• -Dcom.sun.management.jmxremote.ssl
• -Dcom.sun.management.jmxremote.password.file

Likewise, the options ssl, username and password specified in the jmx-exporter configuration file are unused to communicate with a local jmx

Enabling ssl and authentification beetween prometheus and jmx-exporter.

• The jmx-exporter javaagent should be upgraded to a version that supports this feature. (0.20.00 for example)
• Agent and prometheus should be configured to use ssl and authentification as explained in jmx-exporter documentation

Secure each jmxexporter configuration file

• Today, the file is storing the password is world readable. Store configuration files in /etc/service with '600' mode