Adding docs on how to authenticate with prometheus to nifi 2.x.x metrics #786
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ackabletech/nifi-operator into fix/nifi2.0.0-monitoring-docs
|
Is this ready for review @Maleware ? I don't think you requested one yet.. |
|
Yes and no. It's the only working solution, but it will break stuff. I'd talk about it today to see if we want to make the efforts to fix it or leave as is. Depending on this, we can merge it or document a better way. |
|
needs to wait for https://github.com/stackabletech/decisions/issues/54 as this changes the regex expression |
soenkeliebau
moved this from Development: Waiting for Review
to Development: Track
in Stackable Engineering
|
after talking to @adwk67 we are not waiting on the decision of the service name. We will merge with the current implementation ( It's already with listener ) and rework if needed. Moving to |
Maleware
moved this from Development: Track
to Development: Waiting for Review
in Stackable Engineering
razvan
reviewed
Jun 17, 2025
Comment on lines
+138
to
+141
| ==== Known Limitations | ||
|
|
||
| NiFi only allows authentication with JWT on pod level. Therefore you will need one endpoint per NiFi pod and a valid bearer token for each. This is a consequence of NiFi | ||
| moving their metrics endpoint behind a strong authentication mechanism. |
There was a problem hiding this comment.
I would move this to the beginning of the authentication paragraph and update a little like this
Suggested change
| ==== Known Limitations | |
| NiFi only allows authentication with JWT on pod level. Therefore you will need one endpoint per NiFi pod and a valid bearer token for each. This is a consequence of NiFi | |
| moving their metrics endpoint behind a strong authentication mechanism. | |
| [IMPORTANT] | |
| ==== | |
| The NiFi metrics endpoints are behind a strong authentication mechanism which require credentials for each individual pod. | |
| ==== |
| curl -X POST https://simple-nifi-node-default-0.simple-nifi-node-default.<namespace>.svc.cluster.local:8443/nifi-api/access/token -d 'username=<user>&password=<password>' -k | ||
| ---- | ||
|
|
||
| where `-k` equals `verify=false`. The reply is your bearer token. |
There was a problem hiding this comment.
I think it's more important to explain why -k is needed than what it does.
|
|
||
| where `-k` equals `verify=false`. The reply is your bearer token. | ||
|
|
||
| You then can use the bearer token to authenticate with Prometheus replacing `basic_auth` with |
There was a problem hiding this comment.
Suggested change
| You then can use the bearer token to authenticate with Prometheus replacing `basic_auth` with | |
| The following example shows how to configure the Prometheus scraper to use the bearer token to authenticate against a NiFi pod. |
Comment on lines
+63
to
+73
| # basic_auth: | ||
| # username: <user> | ||
| # password: <password> | ||
| authorization: | ||
| type: Bearer | ||
| credentials: "<Bearer Token>" | ||
| tls_config: | ||
| insecure_skip_verify: true | ||
| static_configs: | ||
| - targets: | ||
| - '<pod>.<statefulset>.svc.cluster.local:8443' <1> |
There was a problem hiding this comment.
Suggested change
| # basic_auth: | |
| # username: <user> | |
| # password: <password> | |
| authorization: | |
| type: Bearer | |
| credentials: "<Bearer Token>" | |
| tls_config: | |
| insecure_skip_verify: true | |
| static_configs: | |
| - targets: | |
| - '<pod>.<statefulset>.svc.cluster.local:8443' <1> | |
| authorization: <1> | |
| type: Bearer | |
| credentials: "<Bearer Token>" <2> | |
| tls_config: | |
| insecure_skip_verify: true | |
| static_configs: | |
| - targets: | |
| - '<pod>.<statefulset>.svc.cluster.local:8443' <3> |
| metrics_path: '/nifi-api/flow/metrics/prometheus' | ||
| scheme: https | ||
| ---- | ||
| <1> Static targets only scrapes one pod. |
There was a problem hiding this comment.
Suggested change
| <1> Static targets only scrapes one pod. | |
| <1> Use the `authentication` property instead if the `basic_auth`. | |
| <2> Add the previously obtained token here. | |
| <3> Static targets only scrapes one pod. |
razvan
moved this from Development: Waiting for Review
to Development: In Review
in Stackable Engineering
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Please add a description here. This will become the commit message of the merge request later.
Definition of Done Checklist