prometheus / prometheus/common
web: Support jwt/bearer token auth
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 295
- Forks
- 367
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 18
Description
Adding jwt token auth in addition to basic auth would be a great benefit for in-cluster service authentication.
The kubernetes service account tokens are OIDC compliant and short-living which increases the security compared to static auth basic credentials. the common library could use a JWKS (JSON Web Key Set) to validate the signature of tokens.
Since the common web package is used in a lot of exporters, node_exporter could be secured by jwt auth. Prometheus already support bearer token auth at scrape jobs.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue targets the common web package used by exporters, with node_exporter as an example. Start by locating that package and reviewing its existing basic-auth path alongside Prometheus bearer-token usage. Done means the common package supports validating short-lived JWT/OIDC tokens through a JWKS in addition to basic authentication.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication, backend
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 28/100