Comments (3)
@sumitbaurai There are two usage scenarios:
Java agent
We could add the properties to the exporter YAML for use when loading the SSL configuration for HTTPS.
This could cause configuration confusion since the application's SSL properties may still require the system properties, negating the value of having the SSL configuration for HTTPS in the exporter YAML.
The Java agent is recommended.
Standalone HTTP Server
Java RMI (used by JMX) doesn't provide the necessary configuration hooks to allow non-system properties for RMI SSL configuration.
Here is a great blog on the issue: https://blogger.ziesemer.com/2010/02/jmx-avoid-java-system-properties-rmi.html
TL;DR - it requires custom code in both the Standalone HTTP server and custom code in the application (possibly implemented as a Java agent, simply to bypass using system properties.)
The standalone HTTP server is not recommended.
from jmx_exporter.
Hi Doug,
Is it not the case that the same keystore , truststore can be used for both
- Setting up ssl connection with jmx
- exposing an https url
Isn't something similar to what jmx offers possible.
excerpt from the jmx configuration
com.sun.management.jmxremote.ssl.config.file=filepath
Specifies the location of the SSL configuration file. A properties
file can be used to supply the keystore and truststore location and
password settings thus avoiding to pass them as cleartext in the
command-line.
The current implementation of the out-of-the-box management agent will
look up and use the properties specified below to configure the SSL
keystore and truststore, if present:
javax.net.ssl.keyStore=<keystore-location>
javax.net.ssl.keyStorePassword=<keystore-password>
javax.net.ssl.trustStore=<truststore-location>
javax.net.ssl.trustStorePassword=<truststore-password>
from jmx_exporter.
@sumitbaurai not sure that will help.
Conceptually... the standalone HTTP server exporter...
-
would have to create a new/custom RMI registry with a custom
SslServerSocketFactory
on a non-standard port using a customSSLContext
using custom configuration to load the SSL keystore/truststore files/passwords. -
use the custom
SslServerSocketFactory
in theJmxScraper
code when initiating the connection to the application. -
the application would then use the custom
SslServerSocketFactory
(really just the configuration since the actual class isn't serialized) to connect back to the new/custom RMI registry on the non-standard port. -
the new/custom RMI registry would use the custom
SSLContext
to create theSslServerSocketFactory
to accept the connection.
This all assumes that you can bind a Remote
in the local RMI registry to the custom RMI registry (I have no idea if a Remote
can be bound to two registries or if it can be moved.)
(I'm sure I'm missing something/left out some things.)
The complexities, code changes, integration tests, etc. to support all of this (if it would even work) for the standalone HTTP server exporter (which is not the recommended deployment scenario) simply to prevent a clear-text password doesn't feel like a worthwhile effort.
from jmx_exporter.
Related Issues (20)
- includeObjectNames option issue HOT 5
- Question: Authentication and SSL for jmx_prometheus_javaagent HOT 3
- Can't I use the jmx_exporter/example_configs/kafka-2_0_0.yml file in KRaft mode? HOT 1
- Javaagent can no longer be loaded with /dev/null HOT 5
- start java application with jmx-exporter with a problem HOT 2
- Is there a metric like jmx_up something similar to other standard exporters like mysql_up, mongodb_up or pg_up HOT 1
- Failed to register Collector of type BuildInfoCollector: jmx_exporter_build_info is already in use by another Collector of type BuildInfoCollector HOT 2
- JMX exporter does not expose container port externally via the Agent method HOT 3
- The http response header X-Content-Type-Options ,X-XSS-Protection,X-Frame-Options are missing HOT 1
- NullPointerException during scrape HOT 1
- Is it possible to add custom k8s attributes as labels for Kafka connect JMX metrics HOT 2
- How to create hpa kubernetes based on heap consommation HOT 1
- jmx exporter on an old AIX, v6.1. HOT 5
- Does the expiry/renewal of certificates in jmx_exporter, require restart of service or is it automatically reloaded. HOT 3
- High memory usage by jmx_exporter when connecting to Kafka HOT 1
- Positive match to a rule should not consume the metric HOT 7
- Example config for Tomcat HOT 4
- patterns support for config file for kafka metrics HOT 18
- Question about excludeObjectNames HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from jmx_exporter.