Implement service account token based HTTP authorization #7518
Labels
Comments
exekias
added
enhancement
Metricbeat
23 tasks
|
We already have an appender for this here: https://github.com/elastic/beats/blob/master/metricbeat/autodiscover/appender/kubernetes/token/token.go, it would be nice to fold it into the HTTP helper |
ruflin
pushed a commit
that referenced
this issue
Jul 12, 2018
This change allows to load bearer tokens from files in modules using
the HTTP helper. This is especially useful for Kubernetes and Prometheus, as some deployments enforce SSL access (like OpenShift):
```
- module: kubernetes
metricsets:
- pod
bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
ssl.certificate_authorities:
- /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt
```
Closes #7518
exekias
added a commit
to exekias/beats
that referenced
this issue
Jul 12, 2018
This change allows to load bearer tokens from files in modules using
the HTTP helper. This is especially useful for Kubernetes and Prometheus, as some deployments enforce SSL access (like OpenShift):
```
- module: kubernetes
metricsets:
- pod
bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
ssl.certificate_authorities:
- /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt
```
Closes elastic#7518
(cherry picked from commit 1d3109f)
jsoriano
pushed a commit
that referenced
this issue
Jul 12, 2018
…lper (#7577) * Add `bearer_token_file` paramter to HTTP helper (#7527) This change allows to load bearer tokens from files in modules using the HTTP helper. This is especially useful for Kubernetes and Prometheus, as some deployments enforce SSL access (like OpenShift): ``` - module: kubernetes metricsets: - pod bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token ssl.certificate_authorities: - /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt ``` Closes #7518 (cherry picked from commit 1d3109f) * Update CHANGELOG.asciidoc
leweafan
pushed a commit
to leweafan/beats
that referenced
this issue
Apr 28, 2023
…HTTP helper (elastic#7577) * Add `bearer_token_file` paramter to HTTP helper (elastic#7527) This change allows to load bearer tokens from files in modules using the HTTP helper. This is especially useful for Kubernetes and Prometheus, as some deployments enforce SSL access (like OpenShift): ``` - module: kubernetes metricsets: - pod bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token ssl.certificate_authorities: - /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt ``` Closes elastic#7518 (cherry picked from commit 7b90836) * Update CHANGELOG.asciidoc
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Metricbeat uses HTTP helper to gather metrics from kubelet + many Prometheus endpoints. In order to use the safe port (HTTPS) we need to implement a way to fetch service account token from the metricbeat container. A request like this works:
more on service account tokens:
https://kubernetes.io/docs/concepts/storage/volumes/#projected
https://kubernetes.io/docs/reference/access-authn-authz/authentication/
The text was updated successfully, but these errors were encountered: