Does the latest version support TLS for Prometheus --> exporter data collection

[amgads]

Does the latest version support TLS for Prometheus --> exporter data collection
If yes, any documentation pointer?

[vbezgachev]

Hey, @amgads. This PR, ae031e7, implemented TLS support. I hope it helps.

[amgads]

Thanks Vitaly -- will give it a try

[amgads]

Hi @vbezgachev --
1). We tried to access the exporter as a server similar to our query above "Prometheus --> exporter" where Prometheus or any other client try to scrape from the exporter as a "Server" -- That doesn't seem to work when we specify explicitly "https":
[root@ahs-ncs-2212-cntrl-edge-01 tmp]# curl -s -g -4 https://192.168.1.154:9195/metrics --ssl --cacert /tmp/mxs-server-ca-cert.pem | grep -v '#' | grep maxctrl_up

2). If we try without https or with http, it works which means it is only using http even with maxscale/exporter configured with tls:
[root@ahs-ncs-2212-cntrl-edge-01 tmp]# curl -s -g -4 192.168.1.154:9195/metrics --ssl --cacert /tmp/mxs-server-ca-cert.pem | grep -v '#' | grep maxctrl_up
maxctrl_up 1
[root@ahs-ncs-2212-cntrl-edge-01 tmp]# curl -s -g -4 http://192.168.1.154:9195/metrics --ssl --cacert /tmp/mxs-server-ca-cert.pem | grep -v '#' | grep maxctrl_up
maxctrl_up 1

==> on your documentation at https://github.com/vbezgachev/maxctrl_exporter/blob/master/README.md
It states --> MAXSCALE_CA_CERTIFICATE. Certificate to use to verify a secure connection

Is it possible to scrape an https end-point? Are also aware of any other way to confirm if you support "https" access to the exporter as a server from an external client (i.e. Prometheus)

[amgads]

Appreciate your support!

[vbezgachev]

Hey, @amgads! Currently, the exporter listens and serves HTTP connections - https://github.com/vbezgachev/maxctrl_exporter/blob/master/maxctrl_exporter.go#L363.

log.Fatal(http.ListenAndServe(localIP+":"+maxScaleExporterPort, nil))

I see two possibilities.

Option 1
Start listening and serve on the TLS port. It would be a change in the code like this:

        go func() {
		log.Fatal(http.ListenAndServe(localIP+":"+maxScaleExporterPort, nil))
	}()

	log.Fatal(http.ListenAndServeTLS(localIP+":"+maxScaleExporterPortSecure, certFile, keyFile, nil))

Option 2
Hide the exporter behind, e.g. nginx, and configure nginx to accept HTTP and HTTPS connections.

IMO, the second option is a cleaner solution. Let me know your thoughts.