Merge pull request #71 from smallstep/prometheus

Prometheus

Author: alanchrt

docs/prometheus-node_exporter/config.yaml

@@ -0,0 +1,8 @@
+name: Prometheus (node_exporter)
+protocol: prometheus
+server_port: 9100
+topics:
+  server_auth:
+    links:
+      - text: HTTPS Package for Prometheus
+        url: https://github.com/prometheus/node_exporter/blob/master/https/README.md

docs/prometheus-node_exporter/logo.png

@@ -0,0 +1,24 @@
+Copy the `{{ ca_cert }}` file to a `node_exporter` configuration directory. You may need to make a directory for this, eg. `/etc/node_exporter`.
+
+```shell-session
+$ sudo cp {{ ca_cert }} /etc/node_exporter/root_ca.crt
+```
+
+Make sure these files are owned and readable only by the user that `node_exporter` runs as.
+
+Now modify `/etc/node_exporter/web-config.yml` to require client authentication (in your `tls_server_config` block):
+
+```ini
+tls_server_config:
+  ...
+
+  # RequireAndVerifyClientCert is the most secure option; clients
+  # must present a valid client certificate signed by your CA.
+  client_auth_type: "RequireAndVerifyClientCert"
+
+  # This is the CA the client certificate must be signed by.
+  client_ca_file: "/etc/node_exporter/root_ca.crt"
+
+  ...
+```
+

docs/prometheus-node_exporter/topics/client_auth.md

@@ -0,0 +1,20 @@
+Copy the `{{ server_cert }}` and `{{ server_key }}` files to a `node_exporter` configuration directory. You may need to make a directory for this, eg. `/etc/node_exporter`.
+
+```shell-session
+$ sudo cp {{ server_cert }} /etc/node_exporter/server.crt
+$ sudo cp {{ server_key }} /etc/node_exporter/server.key
+```
+
+Make sure these files are owned and readable only by the user that `node_exporter` runs as.
+
+Now create a file called `/etc/node_exporter/web-config.yml` and configure your `tls_server_config` block to use the server certificate and key:
+
+```ini
+tls_server_config:
+  # This is the server certificate for your `node_exporter` server.
+  cert_file: "/etc/node_exporter/server.crt"
+  key_file: "/etc/node_exporter/server.key"
+
+  ...
+```
+

docs/prometheus-node_exporter/topics/server_auth.md

@@ -0,0 +1,4 @@
+name: Prometheus
+protocol: prometheus
+server_port: 9100
+topics: {}

docs/prometheus/config.yaml

@@ -0,0 +1,23 @@
+Add the following job configuration block to your `prometheus.yml` to authenticate as a client to your targets:
+
+```yaml
+#...
+scrape_configs:
+  - job_name: 'node'
+
+    scheme: https
+    tls_config:
+        # Prometheus will check that the node_exporter presents a certificate
+        # signed by this ca.
+        ca_file: '{{ ca_cert }}'
+        # The cert and key are presented to node_exporter to authenticate
+        # Prometheus as a client.
+        cert_file: '{{ client_cert }}'
+        key_file: '{{ client_key }}'
+
+    static_configs:
+    - targets: ['{{ server_name }}:{{ server_port }}']
+#...
+```
+
+Reload Prometheus, and confirm that the Prometheus dashboard shows your target endpoints as "UP"—and using the `https://` scheme.