search

deis / monitor

Monitoring for Deis Workflow
https://deis.com
MIT License
22 stars 32 forks source link

Make influx ui and api unroutable by default #172

Closed sheerun closed 7 years ago

sheerun commented 7 years ago

I've deployed deis to production and to my surprise influx ui and api is exposed publicly by default.. I'd suggest to make it unroutable by default, and allowing to make it routable by setting router.deis.io/routable: "true".

Secure by default, deis! :)

jchauncey commented 7 years ago

The default configuration of influx and grafana is not meant for production (much like the rest of the workflow install is not targeted for production environments). I would recommend that if you are wanting to monitor a production install of workflow to use an off cluster grafana and influx setup and have the telegraf instances push data to it instead. This will be a more robust setup than what is given with the default configuration.

See - https://github.com/deis/monitor/blob/master/charts/monitor/values.yaml#L30

bacongobbler commented 7 years ago

For reference, the second request is already available as the annotation: https://github.com/deis/monitor/blob/master/charts/monitor/charts/grafana/templates/monitor-grafana-svc.yaml#L9

However we want to keep grafana routable by default, and we couldn't change that now for backwards compatibility reasons. Is there a concern about the instance being publicly available? It is authed by default, and we can fix up #171.

sheerun commented 7 years ago

Grafana is fine to be routable by default as long as it's authenticated as doesn't allow sign-ups

Even influx and grafana isn't yet recommended to run in production, I think making them secure by default would be a nice small step to make them so.

bacongobbler commented 7 years ago

k so let's close this in favour of #171 and get that fixed up.