Re: [prometheus-developers] rbac support for exporter-toolkit

[Julien Pivotto]

On 28 Nov 07:27, Bryan Boreham wrote:
> I see that kube-rbac-proxy both authenticates the caller and performs an 
> authorization request to check whether that caller is allowed.
> 
> Given divided opinions, how about a separate library which implements the 
> feature, and a hook in prometheus/exporter-toolkit so that any similar 
> library can be added at the choice of the exporter.

it looks like this could then be added to the kube-rbac-proxy, but in
general if official exporters do not use it, it does not make sense to
have it on the exporter toolkit.

> 
> Bryan
> 
> 
> On Monday, 28 November 2022 at 12:53:08 UTC Julien Pivotto wrote:
> 
> > On 28 Nov 12:45, Ben Kochie wrote:
> > > Yes, build it in. We don't want to require sidecars for every exporter.
> >
> > I disagree with this, as this sidecar is only required in kubernetes
> > environments. Baking it into the exporter toolkit would be a huge
> > maintenance challenge:
> > - from users - which version of the exporter matches my kube version?
> > (it includes k8s libraries)
> > - from admins - every exporter is larger now
> > - from maintainers - everyone would have to keep the toolkit up to date
> > to match k8s versions and fix potentially critical bugs
> >
> > On the contrary, I find the sidecar pattern great here - first, this is
> > designed exclusively for kube. Second, the same code only needs to be
> > downloaded once per machine, even if you have 10 containers. Then, you
> > manage the version and the config as you wish. You do not depend on your
> > exporter to include the rbac proxy that you need or have a mix of those
> > versions included.
> >
> > > 
> > > On Mon, Nov 28, 2022 at 12:43 PM Stuart Clark 
> > > wrote:
> > > 
> > > > On 2022-11-28 11:40, Ben Kochie wrote:
> > > > > It depends on if the sidecar is with Prometheus or with the target.
> > > > >
> > > > > If it's with Prometheus, that's probably just a docs update.
> > > > >
> > > > > If it's with every exporter, that's probably something we would want
> > > > > in the exporter-toolkit.
> > > > >
> > > > > But, my understanding was that the typical thing here was to use mTLS
> > > > > for securing and authorizing Prometheus.
> > > > >
> > > > > If it's something we need to integrate into every exporter to do some
> > > > > kind of token auth, we might want to consider this.
> > > > >
> > > >
> > > > Do you mean building in the functionality directly into the exporter
> > > > instead of using a sidecar?
> > > >
> > > > --
> > > > Stuart Clark
> > > >
> > > 
> > > -- 
> > > You received this message because you are subscribed to the Google 
> > Groups "Prometheus Developers" group.
> > > To unsubscribe from this group and stop receiving emails from it, send 
> > an email to prometheus-devel...@googlegroups.com.
> > > To view this discussion on the web visit 
> > https://groups.google.com/d/msgid/prometheus-developers/CABbyFmrmeBX5fxbiPzDV%2BYpePy4UqYz%3DQsHJRwtPkob%2BGZ_w5Q%40mail.gmail.com
> > .
> >
> > -- 
> > Julien Pivotto
> > @roidelapluie
> >
> 
> -- 
> You received this message because you are subscribed to the Google Groups 
> "Prometheus Developers" group.
> To unsubscribe from this group and stop receiving emails from it, send an 
> email to prometheus-developers+unsubscr...@googlegroups.com.
> To view this discussion on the web visit 
> https://groups.google.com/d/msgid/prometheus-developers/acf53f10-9cd4-446c-a020-d12f4d12b0bfn%40googlegroups.com.


-- 
Julien Pivotto
@roidelapluie

-- 
You received this message because you are subscribed to the Google Groups 
"Prometheus Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to prometheus-developers+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/prometheus-developers/Y4TTuNU6ipKcjBlb%40nixos.

Re: [prometheus-developers] rbac support for exporter-toolkit

[Bryan Boreham]

I see that kube-rbac-proxy both authenticates the caller and performs an 
authorization request to check whether that caller is allowed.

Given divided opinions, how about a separate library which implements the 
feature, and a hook in prometheus/exporter-toolkit so that any similar 
library can be added at the choice of the exporter.

Bryan


On Monday, 28 November 2022 at 12:53:08 UTC Julien Pivotto wrote:

> On 28 Nov 12:45, Ben Kochie wrote:
> > Yes, build it in. We don't want to require sidecars for every exporter.
>
> I disagree with this, as this sidecar is only required in kubernetes
> environments. Baking it into the exporter toolkit would be a huge
> maintenance challenge:
> - from users - which version of the exporter matches my kube version?
> (it includes k8s libraries)
> - from admins - every exporter is larger now
> - from maintainers - everyone would have to keep the toolkit up to date
> to match k8s versions and fix potentially critical bugs
>
> On the contrary, I find the sidecar pattern great here - first, this is
> designed exclusively for kube. Second, the same code only needs to be
> downloaded once per machine, even if you have 10 containers. Then, you
> manage the version and the config as you wish. You do not depend on your
> exporter to include the rbac proxy that you need or have a mix of those
> versions included.
>
> > 
> > On Mon, Nov 28, 2022 at 12:43 PM Stuart Clark 
> > wrote:
> > 
> > > On 2022-11-28 11:40, Ben Kochie wrote:
> > > > It depends on if the sidecar is with Prometheus or with the target.
> > > >
> > > > If it's with Prometheus, that's probably just a docs update.
> > > >
> > > > If it's with every exporter, that's probably something we would want
> > > > in the exporter-toolkit.
> > > >
> > > > But, my understanding was that the typical thing here was to use mTLS
> > > > for securing and authorizing Prometheus.
> > > >
> > > > If it's something we need to integrate into every exporter to do some
> > > > kind of token auth, we might want to consider this.
> > > >
> > >
> > > Do you mean building in the functionality directly into the exporter
> > > instead of using a sidecar?
> > >
> > > --
> > > Stuart Clark
> > >
> > 
> > -- 
> > You received this message because you are subscribed to the Google 
> Groups "Prometheus Developers" group.
> > To unsubscribe from this group and stop receiving emails from it, send 
> an email to prometheus-devel...@googlegroups.com.
> > To view this discussion on the web visit 
> https://groups.google.com/d/msgid/prometheus-developers/CABbyFmrmeBX5fxbiPzDV%2BYpePy4UqYz%3DQsHJRwtPkob%2BGZ_w5Q%40mail.gmail.com
> .
>
> -- 
> Julien Pivotto
> @roidelapluie
>

-- 
You received this message because you are subscribed to the Google Groups 
"Prometheus Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to prometheus-developers+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/prometheus-developers/acf53f10-9cd4-446c-a020-d12f4d12b0bfn%40googlegroups.com.

Re: [prometheus-developers] rbac support for exporter-toolkit

[Julien Pivotto]

On 28 Nov 12:45, Ben Kochie wrote:
> Yes, build it in. We don't want to require sidecars for every exporter.

I disagree with this, as this sidecar is only required in kubernetes
environments. Baking it into the exporter toolkit would be a huge
maintenance challenge:
- from users - which version of the exporter matches my kube version?
  (it includes k8s libraries)
- from admins - every exporter is larger now
- from maintainers - everyone would have to keep the toolkit up to date
  to match k8s versions and fix potentially critical bugs

On the contrary, I find the sidecar pattern great here - first, this is
designed exclusively for kube. Second, the same code only needs to be
downloaded once per machine, even if you have 10 containers. Then, you
manage the version and the config as you wish. You do not depend on your
exporter to include the rbac proxy that you need or have a mix of those
versions included.

> 
> On Mon, Nov 28, 2022 at 12:43 PM Stuart Clark 
> wrote:
> 
> > On 2022-11-28 11:40, Ben Kochie wrote:
> > > It depends on if the sidecar is with Prometheus or with the target.
> > >
> > > If it's with Prometheus, that's probably just a docs update.
> > >
> > > If it's with every exporter, that's probably something we would want
> > > in the exporter-toolkit.
> > >
> > > But, my understanding was that the typical thing here was to use mTLS
> > > for securing and authorizing Prometheus.
> > >
> > > If it's something we need to integrate into every exporter to do some
> > > kind of token auth, we might want to consider this.
> > >
> >
> > Do you mean building in the functionality directly into the exporter
> > instead of using a sidecar?
> >
> > --
> > Stuart Clark
> >
> 
> -- 
> You received this message because you are subscribed to the Google Groups 
> "Prometheus Developers" group.
> To unsubscribe from this group and stop receiving emails from it, send an 
> email to prometheus-developers+unsubscr...@googlegroups.com.
> To view this discussion on the web visit 
> https://groups.google.com/d/msgid/prometheus-developers/CABbyFmrmeBX5fxbiPzDV%2BYpePy4UqYz%3DQsHJRwtPkob%2BGZ_w5Q%40mail.gmail.com.

-- 
Julien Pivotto
@roidelapluie

-- 
You received this message because you are subscribed to the Google Groups 
"Prometheus Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to prometheus-developers+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/prometheus-developers/Y4SvLhAxbepv6dyh%40nixos.

Re: [prometheus-developers] rbac support for exporter-toolkit

[Jesús Samitier]

instead of adding kube-rbac-proxy as a sidecar, integrating with Kubernetes
ServiceAccount + RBAC could be done directly using the Kube api.

On Mon, Nov 28, 2022 at 12:45 PM Ben Kochie  wrote:

> Yes, build it in. We don't want to require sidecars for every exporter.
>
> On Mon, Nov 28, 2022 at 12:43 PM Stuart Clark 
> wrote:
>
>> On 2022-11-28 11:40, Ben Kochie wrote:
>> > It depends on if the sidecar is with Prometheus or with the target.
>> >
>> > If it's with Prometheus, that's probably just a docs update.
>> >
>> > If it's with every exporter, that's probably something we would want
>> > in the exporter-toolkit.
>> >
>> > But, my understanding was that the typical thing here was to use mTLS
>> > for securing and authorizing Prometheus.
>> >
>> > If it's something we need to integrate into every exporter to do some
>> > kind of token auth, we might want to consider this.
>> >
>>
>> Do you mean building in the functionality directly into the exporter
>> instead of using a sidecar?
>>
>> --
>> Stuart Clark
>>
>

-- 
You received this message because you are subscribed to the Google Groups 
"Prometheus Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to prometheus-developers+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/prometheus-developers/CAAAOEo1Cjr99SdYuiDM-68z0_k36KV0YjHU7Htq3N7VQ6-bm2Q%40mail.gmail.com.

Re: [prometheus-developers] rbac support for exporter-toolkit

[Ben Kochie]

Yes, build it in. We don't want to require sidecars for every exporter.

On Mon, Nov 28, 2022 at 12:43 PM Stuart Clark 
wrote:

> On 2022-11-28 11:40, Ben Kochie wrote:
> > It depends on if the sidecar is with Prometheus or with the target.
> >
> > If it's with Prometheus, that's probably just a docs update.
> >
> > If it's with every exporter, that's probably something we would want
> > in the exporter-toolkit.
> >
> > But, my understanding was that the typical thing here was to use mTLS
> > for securing and authorizing Prometheus.
> >
> > If it's something we need to integrate into every exporter to do some
> > kind of token auth, we might want to consider this.
> >
>
> Do you mean building in the functionality directly into the exporter
> instead of using a sidecar?
>
> --
> Stuart Clark
>

-- 
You received this message because you are subscribed to the Google Groups 
"Prometheus Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to prometheus-developers+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/prometheus-developers/CABbyFmrmeBX5fxbiPzDV%2BYpePy4UqYz%3DQsHJRwtPkob%2BGZ_w5Q%40mail.gmail.com.

Re: [prometheus-developers] rbac support for exporter-toolkit

[Stuart Clark]

On 2022-11-28 11:40, Ben Kochie wrote:

It depends on if the sidecar is with Prometheus or with the target.

If it's with Prometheus, that's probably just a docs update.

If it's with every exporter, that's probably something we would want
in the exporter-toolkit.

But, my understanding was that the typical thing here was to use mTLS
for securing and authorizing Prometheus.

If it's something we need to integrate into every exporter to do some
kind of token auth, we might want to consider this.



Do you mean building in the functionality directly into the exporter 
instead of using a sidecar?


--
Stuart Clark

--
You received this message because you are subscribed to the Google Groups 
"Prometheus Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to prometheus-developers+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/prometheus-developers/e723d741f1ceee469483d71c9e5b66e1%40Jahingo.com.

Re: [prometheus-developers] rbac support for exporter-toolkit

[Ben Kochie]

It depends on if the sidecar is with Prometheus or with the target.

If it's with Prometheus, that's probably just a docs update.

If it's with every exporter, that's probably something we would want in the
exporter-toolkit.

But, my understanding was that the typical thing here was to use mTLS for
securing and authorizing Prometheus.

If it's something we need to integrate into every exporter to do some kind
of token auth, we might want to consider this.

On Mon, Nov 28, 2022 at 11:59 AM Stuart Clark 
wrote:

> On 2022-11-28 10:56, Jesús Samitier wrote:
> > Hi
> >
> > The idea is to integrate kube-rbac-proxy to add an extra (and
> > optional) security feature in a new exporter, so the final user can
> > rely on RBAC to assure that only Prometheus can scrape its metrics.
> > This is something you get when you install Prometheus in K8s using the
> > official helm chart - only Prometheus can scrape the Prometheus
> > metrics exposed by the K8s internals. The idea is to have something
> > similar but for any exporter.
> >
> > Any developer can integrate it in its exporter (as shown here
> >
> https://www.brancz.com/2018/02/27/using-kube-rbac-proxy-to-secure-kubernetes-workloads
> ),
> > but someone pointed out on Mastodon that we could also integrate in in
> > the exporter toolkit so it's even easier.
> >
>
> What would actually be needed in the toolkit though? Is it just some
> docs explaining how to deploy the sidecar with the exporter, or actual
> code changes?
>
> --
> Stuart Clark
>
> --
> You received this message because you are subscribed to the Google Groups
> "Prometheus Developers" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to prometheus-developers+unsubscr...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/prometheus-developers/3883faab86ed1a93de7ad2d8f8598ea5%40Jahingo.com
> .
>

-- 
You received this message because you are subscribed to the Google Groups 
"Prometheus Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to prometheus-developers+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/prometheus-developers/CABbyFmqkO%2B5fexC%3D0674BdG83Up8rYJYmHt_ooMqGHybPv%3DYww%40mail.gmail.com.

Re: [prometheus-developers] rbac support for exporter-toolkit

[Stuart Clark]

On 2022-11-28 11:01, Jesús Samitier wrote:

Yeah, maybe add some documentation with example configurations.



If it just some docs I don't see any issue?

--
Stuart Clark

--
You received this message because you are subscribed to the Google Groups 
"Prometheus Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to prometheus-developers+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/prometheus-developers/756378d93ef162cbf2f8b9328684eaeb%40Jahingo.com.

Re: [prometheus-developers] rbac support for exporter-toolkit

[Jesús Samitier]

Yeah, maybe add some documentation with example configurations.

On Mon, Nov 28, 2022 at 11:59 AM Stuart Clark 
wrote:

> On 2022-11-28 10:56, Jesús Samitier wrote:
> > Hi
> >
> > The idea is to integrate kube-rbac-proxy to add an extra (and
> > optional) security feature in a new exporter, so the final user can
> > rely on RBAC to assure that only Prometheus can scrape its metrics.
> > This is something you get when you install Prometheus in K8s using the
> > official helm chart - only Prometheus can scrape the Prometheus
> > metrics exposed by the K8s internals. The idea is to have something
> > similar but for any exporter.
> >
> > Any developer can integrate it in its exporter (as shown here
> >
> https://www.brancz.com/2018/02/27/using-kube-rbac-proxy-to-secure-kubernetes-workloads
> ),
> > but someone pointed out on Mastodon that we could also integrate in in
> > the exporter toolkit so it's even easier.
> >
>
> What would actually be needed in the toolkit though? Is it just some
> docs explaining how to deploy the sidecar with the exporter, or actual
> code changes?
>
> --
> Stuart Clark
>

-- 
You received this message because you are subscribed to the Google Groups 
"Prometheus Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to prometheus-developers+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/prometheus-developers/CAAAOEo2mr_WLzJhd8y7wXf_8BKZs0Orsws9JNuvUUZyMaxoE6w%40mail.gmail.com.

Re: [prometheus-developers] rbac support for exporter-toolkit

[Stuart Clark]

On 2022-11-28 10:56, Jesús Samitier wrote:

Hi

The idea is to integrate kube-rbac-proxy to add an extra (and
optional) security feature in a new exporter, so the final user can
rely on RBAC to assure that only Prometheus can scrape its metrics.
This is something you get when you install Prometheus in K8s using the
official helm chart - only Prometheus can scrape the Prometheus
metrics exposed by the K8s internals. The idea is to have something
similar but for any exporter.

Any developer can integrate it in its exporter (as shown here
https://www.brancz.com/2018/02/27/using-kube-rbac-proxy-to-secure-kubernetes-workloads),
but someone pointed out on Mastodon that we could also integrate in in
the exporter toolkit so it's even easier.



What would actually be needed in the toolkit though? Is it just some 
docs explaining how to deploy the sidecar with the exporter, or actual 
code changes?


--
Stuart Clark

--
You received this message because you are subscribed to the Google Groups 
"Prometheus Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to prometheus-developers+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/prometheus-developers/3883faab86ed1a93de7ad2d8f8598ea5%40Jahingo.com.

Re: [prometheus-developers] rbac support for exporter-toolkit

[Jesús Samitier]

Hi

The idea is to integrate kube-rbac-proxy to add an extra (and optional)
security feature in a new exporter, so the final user can rely on RBAC to
assure that only Prometheus can scrape its metrics. This is something you
get when you install Prometheus in K8s using the official helm chart - only
Prometheus can scrape the Prometheus metrics exposed by the K8s internals.
The idea is to have something similar but for any exporter.

Any developer can integrate it in its exporter (as shown here
https://www.brancz.com/2018/02/27/using-kube-rbac-proxy-to-secure-kubernetes-workloads),
but someone pointed out on Mastodon that we could also integrate in in the
exporter toolkit so it's even easier.

Thanks!

[image: image.png]
(https://mastodon.social/@mrueg/109315967734903276)




On Mon, Nov 28, 2022 at 11:39 AM Bryan Boreham  wrote:

> What is meant by "add rbac support to the exporter-toolkit
> " ?
>
> I have been using Kubernetes and Prometheus for many years; I know what
> RBAC is but cannot immediately see how an exporter would want to write code
> that references it.
>
> Bryan
>
> On Friday, 25 November 2022 at 12:01:32 UTC Julien Pivotto wrote:
>
>> I am surprised by this, it looks a huge maintenance burden and
>> potentially would add a lot of disk space to all the exporters that is
>> shared between all if you use a sidecar.
>>
>> We also, as you point out, have many users just not deploying to kube.
>>
>> On 10 Nov 05:44, Jesús Samitier wrote:
>> > Hi,
>> >
>> > It was great to see all of you in Munich!
>> >
>> > After our talk about securing Prometheus in K8s, we received a message
>> in
>> > Mastodon suggesting us that it'd be a good idea to add rbac support to
>> the
>> > exporter-toolkit . I'm
>> not
>> > sure because you don't always deploy your exporters in Kubernetes, so
>> > wanted to ask to the community.
>> >
>> > If someone thinks that this could be useful for the project, we'd be
>> glad
>> > to contribute.
>> >
>> > Thanks!
>> >
>> > --
>> > You received this message because you are subscribed to the Google
>> Groups "Prometheus Developers" group.
>> > To unsubscribe from this group and stop receiving emails from it, send
>> an email to prometheus-devel...@googlegroups.com.
>> > To view this discussion on the web visit
>> https://groups.google.com/d/msgid/prometheus-developers/edc5b581-edc7-49ea-8906-1e81281e4209n%40googlegroups.com.
>>
>>
>>
>> --
>> Julien Pivotto
>> @roidelapluie
>>
> --
> You received this message because you are subscribed to a topic in the
> Google Groups "Prometheus Developers" group.
> To unsubscribe from this topic, visit
> https://groups.google.com/d/topic/prometheus-developers/q7M_dDLU0nY/unsubscribe
> .
> To unsubscribe from this group and all its topics, send an email to
> prometheus-developers+unsubscr...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/prometheus-developers/c4d87f55-d74f-4d48-bd59-2c42eadec169n%40googlegroups.com
> 
> .
>

-- 
You received this message because you are subscribed to the Google Groups 
"Prometheus Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to prometheus-developers+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/prometheus-developers/CAAAOEo1u51J1Oit2PtbfsC0SpAh2YRni9-uqUJakLu2bu9V-7g%40mail.gmail.com.

Re: [prometheus-developers] rbac support for exporter-toolkit

[Bryan Boreham]

What is meant by "add rbac support to the exporter-toolkit 
" ?

I have been using Kubernetes and Prometheus for many years; I know what 
RBAC is but cannot immediately see how an exporter would want to write code 
that references it.

Bryan

On Friday, 25 November 2022 at 12:01:32 UTC Julien Pivotto wrote:

> I am surprised by this, it looks a huge maintenance burden and
> potentially would add a lot of disk space to all the exporters that is
> shared between all if you use a sidecar.
>
> We also, as you point out, have many users just not deploying to kube.
>
> On 10 Nov 05:44, Jesús Samitier wrote:
> > Hi,
> > 
> > It was great to see all of you in Munich! 
> > 
> > After our talk about securing Prometheus in K8s, we received a message 
> in 
> > Mastodon suggesting us that it'd be a good idea to add rbac support to 
> the 
> > exporter-toolkit . I'm 
> not 
> > sure because you don't always deploy your exporters in Kubernetes, so 
> > wanted to ask to the community.
> > 
> > If someone thinks that this could be useful for the project, we'd be 
> glad 
> > to contribute.
> > 
> > Thanks!
> > 
> > -- 
> > You received this message because you are subscribed to the Google 
> Groups "Prometheus Developers" group.
> > To unsubscribe from this group and stop receiving emails from it, send 
> an email to prometheus-devel...@googlegroups.com.
> > To view this discussion on the web visit 
> https://groups.google.com/d/msgid/prometheus-developers/edc5b581-edc7-49ea-8906-1e81281e4209n%40googlegroups.com
> .
>
>
> -- 
> Julien Pivotto
> @roidelapluie
>

-- 
You received this message because you are subscribed to the Google Groups 
"Prometheus Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to prometheus-developers+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/prometheus-developers/c4d87f55-d74f-4d48-bd59-2c42eadec169n%40googlegroups.com.

Re: [prometheus-developers] rbac support for exporter-toolkit

[Julien Pivotto]

I am surprised by this, it looks a huge maintenance burden and
potentially would add a lot of disk space to all the exporters that is
shared between all if you use a sidecar.

We also, as you point out, have many users just not deploying to kube.

On 10 Nov 05:44, Jesús Samitier wrote:
> Hi,
> 
> It was great to see all of you in Munich! 
> 
> After our talk about securing Prometheus in K8s, we received a message in 
> Mastodon suggesting us that it'd be a good idea to add rbac support to the 
> exporter-toolkit . I'm not 
> sure because you don't always deploy your exporters in Kubernetes, so 
> wanted to ask to the community.
> 
> If someone thinks that this could be useful for the project, we'd be glad 
> to contribute.
> 
> Thanks!
> 
> -- 
> You received this message because you are subscribed to the Google Groups 
> "Prometheus Developers" group.
> To unsubscribe from this group and stop receiving emails from it, send an 
> email to prometheus-developers+unsubscr...@googlegroups.com.
> To view this discussion on the web visit 
> https://groups.google.com/d/msgid/prometheus-developers/edc5b581-edc7-49ea-8906-1e81281e4209n%40googlegroups.com.


-- 
Julien Pivotto
@roidelapluie

-- 
You received this message because you are subscribed to the Google Groups 
"Prometheus Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to prometheus-developers+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/prometheus-developers/Y31aWXach027GhYy%40nixos.

[prometheus-developers] rbac support for exporter-toolkit

[Jesús Samitier]

Hi,

It was great to see all of you in Munich! 

After our talk about securing Prometheus in K8s, we received a message in 
Mastodon suggesting us that it'd be a good idea to add rbac support to the 
exporter-toolkit . I'm not 
sure because you don't always deploy your exporters in Kubernetes, so 
wanted to ask to the community.

If someone thinks that this could be useful for the project, we'd be glad 
to contribute.

Thanks!

-- 
You received this message because you are subscribed to the Google Groups 
"Prometheus Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to prometheus-developers+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/prometheus-developers/edc5b581-edc7-49ea-8906-1e81281e4209n%40googlegroups.com.