2023年2月18日大约 3 分钟云原生PrometheusSpring Boot
一般地，我们使用Prometheus对SpringBoot应用进行监控时，没有做任何认证，监控接口是完全开放的，我们直接访问暴露出来的指标接口http://localhost:8081/actuator/prometheus就可以拿到指标接口，这在某些程度上不安全。。
我们需要给我们的监控指标接口添加一个Base认证。
我这里是SpringBoot2.3.9版本，在添加spring-boot-starter-actuator和micrometer-registry-prometheus做指标暴露外，还在此基础之上还需要添加spring-boot-starter-security包。
<!-- 监控检查及度量 -->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-actuator</artifactId>
</dependency>
<dependency>
<groupId>io.micrometer</groupId>
<artifactId>micrometer-registry-prometheus</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
添加配置类以拦截指标暴露Endpoint端口，ENDPOINT_ADMIN角色可自定义：
import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
@Configuration(proxyBeanMethods = false)
public class ActuatorSecurity extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http.requestMatcher(EndpointRequest.toAnyEndpoint()).authorizeRequests((requests) ->
requests.anyRequest().hasRole("ENDPOINT_ADMIN"));
http.httpBasic();
}
}
添加配置：
management:
server:
port: 8081
endpoints:
web:
exposure:
include: "*"
spring:
security:
user:
name: admin
password: admin
roles: ENDPOINT_ADMIN
默认情况下，health健康检查端口不会被认证拦截，如需要添加，还需要如下配置
management:
endpoint:
health:
roles: ENDPOINT_ADMIN
这时候就添加了认证，再次访问指标接口就需要添加Basic认证了。
curl -u admin:admin http://192.168.96.196:8081/actuator/prometheus
我们的Prometheus采用Operator安装，所以只需要修改PodMonitor和ServiceMonitor就可以了。如果没有使用Operator可能需要修改Prometheus本身的job，可参考：https://prometheus.io/docs/prometheus/latest/configuration/configuration/#scrape_config
Secret中有两个key分别是username和password，值是对应的明文Base64后的。
apiVersion: v1
kind: Secret
metadata:
name: basic-auth
namespace: metric-yyc
data:
password: YWRtaW4= # base64 字符串 admin
username: YWRtaW4=
在spec.endpoints下添加basicAuth，如下：
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
labels:
yyc: app
name: service-out
namespace: metric-yyc
spec:
endpoints:
- interval: 10s
path: /metrics
port: metric
basicAuth: # 添加认证
password:
name: basic-auth
key: password
username:
name: basic-auth
key: username
relabelings:
- action: replace
regex: ([^:]+)(?::\d+)?;(\d+)
replacement: $1:$2
sourceLabels:
- __address__
- __meta_kubernetes_service_annotation_prometheus_io_port
targetLabel: __address__
- action: replace
regex: (.*)
replacement: $1
sourceLabels:
- __meta_kubernetes_service_annotation_prometheus_io_path
targetLabel: __metrics_path__
namespaceSelector:
matchNames:
- app-yyc # 需要选择的namespace
selector:
matchLabels:
prometheus.io/scrape: "true"
yyc.metric.auth: "true" # 自定义一个label用于匹配需要认证的service
在spec.podMetricsEndpoints下添加basicAuth，如下：
apiVersion: monitoring.coreos.com/v1
kind: PodMonitor
metadata:
labels:
yyc: app
name: pod-out
namespace: metric-yyc
spec:
namespaceSelector:
matchNames:
- app-yyc # 需要选择的namespace
podMetricsEndpoints:
- interval: 15s
path: /actuator/prometheus
port: metric
basicAuth: # 添加认证
password:
name: basic-auth
key: password
username:
name: basic-auth
key: username
relabelings:
- action: replace
regex: ([^:]+)(?::\d+)?;(\d+)
replacement: $1:$2
sourceLabels:
- __address__
- __meta_kubernetes_pod_annotation_prometheus_io_port
targetLabel: __address__
- action: replace
regex: (.*)
replacement: $1
sourceLabels:
- __meta_kubernetes_pod_annotation_prometheus_io_path
targetLabel: __metrics_path__
selector:
matchLabels:
prometheus.io/scrape: "true"
yyc.metric.auth: "true" # 自定义一个label用于匹配需要认证的service
这样Prometheus就可以在采集数据指标时自动加上Base认证了。
这里遇到一个坑就是Prometheus Operator在较低的版本中的PodMonitor不支持basicAuth字段，注意查看对应版本prometheus-operator-crd的定义[^1]。
1:https://www.amitph.com/how-to-secure-spring-boot-actuator-endpoints/
3:https://github.com/prometheus-operator/prometheus-operator/tree/main/example/prometheus-operator-crd
4: Spring Boot Actuator https://blog.csdn.net/weixin_50518271/article/details/111183826 ，https://blog.csdn.net/weixin_50518271/article/details/111237298
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。