prometheus / prometheus/common
SPIFFE scrape support
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 295
- Forks
- 367
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 18
Description
The SPIFFE Workload API can be used to get a tls client key/certificate and keep it up to date (they typically rotate hourly). Exporters can then verify that only the spiffe id associated with Prometheus is able to fetch data from them.
I'm thinking there should be two new options added,
in scrape_config.tls_config, an option added for saying to use spiffe for this target
and an option up at the global section to specify where the spiffeSocketPath
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the configuration definitions for scrape_config.tls_config and the global configuration, then trace how TLS settings are consumed for a target. Review the SPIFFE Workload API requirements and existing configuration tests; done means both requested configuration points support the stated SPIFFE certificate use case and the behavior is tested.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100