Adding Scrape Credentials to Node Exporter

1. Background

Node Exporter is a common component in the Prometheus ecosystem for collecting host metrics, but by default it does not provide access authentication. This article describes how to add basic authentication to Node Exporter in a Kubernetes environment to improve security.

2. Configuring Credentials for Node Exporter

2.1 Generating an Encrypted Password

Use the htpasswd tool to generate an encrypted password:

1
htpasswd -nBC 12 "" | tr -d ':\n'

You need to enter a password here, and the generated output will be an encrypted password string.

2.2 Creating the web-config.yml Configuration File

First, create a configuration file containing the basic authentication user information:

1
vim web-config.yml

Add the following content:

1
2
basic_auth_users:
  default: $2y$12$yEap0I9iBtuuLBdvL51LU.xxx.xxx

Here default is the username, and the string after it is the encrypted password generated by htpasswd.

2.3 Creating a ConfigMap

Use web-config.yml to create a ConfigMap so that it can be used in the Node Exporter DaemonSet:

1
2
3
kubectl create configmap node-exporter-web-config \
  --from-file=web-config.yml=web-config.yml \
  -n monitoring

2.4 Modifying the Node Exporter DaemonSet

Edit the Node Exporter DaemonSet configuration to load the authentication configuration:

1
kubectl -n monitoring edit ds node-exporter

Add the startup argument and mount the ConfigMap:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
containers:
  - name: node-exporter
    image: prom/node-exporter:master
    imagePullPolicy: IfNotPresent
    args:
      - --web.config.file=/etc/node-exporter/web-config.yml
    ports:
      - containerPort: 9100
        hostPort: 9100
        name: scrape
        protocol: TCP
    volumeMounts:
      - name: web-config
        mountPath: /etc/node-exporter/web-config.yml
        subPath: web-config.yml
volumes:
  - name: web-config
    configMap:
      name: node-exporter-web-config

3. Adding Credentials on the Scrape Side

3.1 Creating the Authentication Credential Secret

Create a Secret containing the access credentials for Prometheus:

1
2
3
4
kubectl create secret generic node-exporter-basic-auth \
  --from-literal=username='default' \
  --from-literal=password='xxx' \
  -n monitoring

3.2 Configuring the ServiceMonitor

Update the ServiceMonitor configuration to use the authentication credentials:

1
kubectl -n monitoring edit servicemonitor ops-node-exporter

Add the basicAuth configuration:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  labels:
    tier: ops
  name: ops-node-exporter
  namespace: monitoring
spec:
  endpoints:
    - interval: 15s
      basicAuth:
        username:
          name: node-exporter-basic-auth
          key: username
        password:
          name: node-exporter-basic-auth
          key: password
      port: metric