summaryrefslogtreecommitdiff
path: root/roles
diff options
context:
space:
mode:
authorChristian Pointner <equinox@spreadspace.org>2021-06-02 02:25:33 +0200
committerChristian Pointner <equinox@spreadspace.org>2021-06-20 01:44:16 +0200
commit96232fb34906f9efd98189838141d896668d3dd8 (patch)
tree99189ec79f80f7817048d1909c3f85e2d80cc297 /roles
parentprometheus: server CA and certificates (diff)
prometheus: preliminary tls support for exporter connections
Diffstat (limited to 'roles')
-rw-r--r--roles/monitoring/prometheus/exporter/base/tasks/main.yml4
-rw-r--r--roles/monitoring/prometheus/exporter/base/tasks/tls.yml61
-rw-r--r--roles/monitoring/prometheus/exporter/base/templates/service.j22
-rw-r--r--roles/monitoring/prometheus/server/templates/prometheus.yml.j27
4 files changed, 71 insertions, 3 deletions
diff --git a/roles/monitoring/prometheus/exporter/base/tasks/main.yml b/roles/monitoring/prometheus/exporter/base/tasks/main.yml
index fab6ff7b..9a214f39 100644
--- a/roles/monitoring/prometheus/exporter/base/tasks/main.yml
+++ b/roles/monitoring/prometheus/exporter/base/tasks/main.yml
@@ -23,8 +23,8 @@
home: /nonexistent
create_home: no
-## TODO:
-## - create certificate/key
+- name: create TLS certificate and key
+ import_tasks: tls.yml
- name: generate systemd service unit
template:
diff --git a/roles/monitoring/prometheus/exporter/base/tasks/tls.yml b/roles/monitoring/prometheus/exporter/base/tasks/tls.yml
new file mode 100644
index 00000000..b2731b09
--- /dev/null
+++ b/roles/monitoring/prometheus/exporter/base/tasks/tls.yml
@@ -0,0 +1,61 @@
+---
+- name: install python-cryptoraphy
+ apt:
+ name: "{{ python_basename }}-cryptography"
+ state: present
+
+- name: create base directory
+ file:
+ path: /etc/ssl/prometheus
+ state: directory
+
+- name: create exporter cert/key directory
+ file:
+ path: /etc/ssl/prometheus/exporter
+ state: directory
+ owner: root
+ group: prometheus-exporter
+ mode: 0750
+
+- name: create exporter private key
+ openssl_privatekey:
+ path: /etc/ssl/prometheus/exporter/key.pem
+ type: RSA
+ size: 4096
+ owner: prometheus-exporter
+ group: prometheus-exporter
+ mode: 0400
+ notify: restart prometheus-exporter-exporter
+
+- name: create signing request for exporter certificate
+ openssl_csr:
+ path: /etc/ssl/prometheus/exporter/csr.pem
+ privatekey_path: /etc/ssl/prometheus/exporter/key.pem
+ CN: "{{ inventory_hostname }}"
+ subject_alt_name:
+ - "DNS:{{ host_name }}.{{ host_domain }}"
+ - "IP:{{ ansible_default_ipv4.address }}"
+ key_usage:
+ - digitalSignature
+ key_usage_critical: yes
+ extended_key_usage:
+ - serverAuth
+ extended_key_usage_critical: yes
+ basic_constraints:
+ - 'CA:FALSE'
+ basic_constraints_critical: yes
+
+## TODO: implement remote singing using server
+
+- name: create exporter certificate
+ openssl_certificate:
+ path: /etc/ssl/prometheus/exporter/crt.pem
+ csr_path: /etc/ssl/prometheus/exporter/csr.pem
+ provider: ownca
+ ownca_path: /etc/ssl/prometheus/ca-crt.pem
+ ownca_privatekey_path: /etc/ssl/prometheus/ca/key.pem
+ ownca_digest: sha256
+ ownca_not_after: "+18250d" ## 50 years
+ notify: restart prometheus-exporter-exporter
+
+## TODO: install /etc/ssl/prometheus/ca-crt.pem from server
diff --git a/roles/monitoring/prometheus/exporter/base/templates/service.j2 b/roles/monitoring/prometheus/exporter/base/templates/service.j2
index e2c54d6c..c24baf43 100644
--- a/roles/monitoring/prometheus/exporter/base/templates/service.j2
+++ b/roles/monitoring/prometheus/exporter/base/templates/service.j2
@@ -4,7 +4,7 @@ Description=Prometheus exporter proxy
[Service]
Restart=always
User=prometheus-exporter
-ExecStart=/usr/bin/prometheus-exporter-exporter --config.dirs=/etc/prometheus/exporter/enabled --config.file="" --web.listen-address="{{ prometheus_exporter_listen }}"
+ExecStart=/usr/bin/prometheus-exporter-exporter -config.dirs=/etc/prometheus/exporter/enabled -config.file="" -web.listen-address="" -web.tls.listen-address="{{ prometheus_exporter_listen }}" -web.tls.cert="/etc/ssl/prometheus/exporter/crt.pem" -web.tls.key="/etc/ssl/prometheus/exporter/key.pem" --web.tls.ca="/etc/ssl/prometheus/ca-crt.pem" -web.tls.verify
{# TODO: implement reloading once the exporter_exporter supports this #}
# systemd hardening-options
diff --git a/roles/monitoring/prometheus/server/templates/prometheus.yml.j2 b/roles/monitoring/prometheus/server/templates/prometheus.yml.j2
index 007afa90..e94ea043 100644
--- a/roles/monitoring/prometheus/server/templates/prometheus.yml.j2
+++ b/roles/monitoring/prometheus/server/templates/prometheus.yml.j2
@@ -9,6 +9,8 @@ scrape_configs:
- job_name: 'prometheus'
static_configs:
- targets: ['localhost:9090']
+ labels:
+ instance: "{{ inventory_hostname }}"
{% for job in prometheus_server_jobs %}
- job_name: '{{ job }}'
@@ -16,6 +18,11 @@ scrape_configs:
params:
module:
- {{ job }}
+ scheme: https
+ tls_config:
+ ca_file: /etc/ssl/prometheus/ca-crt.pem
+ cert_file: /etc/ssl/prometheus/server/exporter-crt.pem
+ key_file: /etc/ssl/prometheus/server/exporter-key.pem
file_sd_configs:
- files:
- "/etc/prometheus/jobs/{{ job }}/*.yml"