prometheus配置HTTPS

一、参数说明

prometheus默认自带“--web.config.file”参数，允许添加认证用户信息和TLS。

二、创建认证用户密码和TLS认证信息

2.1、创建认证用户

[root@localhost ~]# mkdir -p /usr/local/prometheus/auth/;cd /usr/local/prometheus/auth/
[root@localhost auth]# htpasswd -nBC 8 ''|tr -d ':\n'
New password: 
Re-type new password: 
$2y$08$ryHl1UBDkPrMVKti8ydYpuAZdLf.rYpaQNjw2fRmD2Z.jraeSfc6S

2.2、创建key和crt认证文件

[root@localhost auth]# openssl req  -x509 -newkey rsa:4096  -nodes  -keyout prom.key -out prom.crt
Generating a 4096 bit RSA private key
..........................................................................................................++
......................................................................................................................................................................++
writing new private key to 'prometheus.linuxpanda.tech.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:
State or Province Name (full name) []:
Locality Name (eg, city) [Default City]:Beijing
Organization Name (eg, company) [Default Company Ltd]:ali       
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:
Email Address []:
[root@localhost auth]# ls
prom.crt
prom.key

三、配置prometheus启动文件，配置"auth.yml"

[root@localhost auth]# vim /usr/local/prometheus/auth/auth.yml
basic_auth_users:
  admin: $2y$08$ryHl1UBDkPrMVKti8ydYpuAZdLf.rYpaQNjw2fRmD2Z.jraeSfc6S
tls_server_config:
  cert_file: prom.crt
  key_file: prom.key

注意：“basic_auth_users”规则是用户名对应生成的密码，并可以添加多个账户，例如：

basic_auth_users:
  admin: $2y$08$ryHl1UBDkPrMVKti8ydYpuAZdLf.rYpaQNjw2fRmD2Z.jraeSfc6S
  admin1: $2y$08$BgmePVs0ElPEA5K8Z7unzOXUJfSQl1GnO.bxlUiNPgy9D3HygV6Sy

并且“basic_auth_users”和“tls_server_config”都是单独配置，单独配置任意一个都可以。并且此番是配置在prometheus agent模式中仍然支持。

四、配置prometheus采集TLS自身指标

[root@localhost config]# vim prometheus.yml
scrape_configs:
  - job_name: "prometheus"
    scheme: https
    tls_config:
      ca_file: /usr/local/prometheus/auth/prom.crt
      insecure_skip_verify: true
    basic_auth:
      username: admin
      password: 123456
    static_configs:
    - targets: ['localhost:9090']

注意，因为证书是自己生成的，所以“insecure_skip_verify: true”必须开启，否则认证报错。