The password in the Prometheus configuration file needs to support encrypted storage. about prometheus HOT 5 OPEN

Yes, you can use password_file and store the password on another filesystem.

from prometheus.

@roidelapluie How can I separate the basic_auth authentication information for monitoring targets in the prometheus.yml file into a separate file? And how can Prometheus associate and read this password file when loading the prometheus.yml file during startup? It seems not feasible, as the authentication I mentioned is not the basic authentication of Prometheus itself, but the basic authentication information for Prometheus monitoring targets.

from prometheus.

Here's how to separate basic authentication information using password_file in Prometheus:

1. Create Password File:

   • Create password.txt containing:

     your_password
     

2. Update prometheus.yml:

   global:
     scrape_interval: 15s
   
   scrape_configs:
     - job_name: 'example'
       static_configs:
         - targets: ['example.com']
       basic_auth:
         username: 'your_username'
         password_file: '/path/to/password.txt'

3. Secure Password File:

   chmod 600 /path/to/password.txt
   chown prometheus:prometheus /path/to/password.txt

4. Reload Prometheus Configuration:

   curl -X POST http://localhost:9090/-/reload

This separates the password securely into a file and updates the Prometheus configuration to use it.

from prometheus.

@roidelapluie thanks very much，but this method merely isolates the password into a separate file, however, this password file cannot be encrypted, which still fails to meet security requirements. I am wondering if the Prometheus team could modify the code to support encrypted transmission of basic authentication passwords for these jobs. It would be much anticipated for the official support to be in place.

from prometheus.

If the password is encrypted, Prometheus would still need to decrypt it at runtime, which means the decryption key or method would also need to be accessible to Prometheus. This would ultimately not improve security, as the key could also be a target for attackers.

The best practice in such cases is to ensure that the password file is stored securely, with strict access controls and auditing in place to monitor any access to it...

from prometheus.