Support configuration through environment variables about haproxy_exporter HOT 10 CLOSED

+1

from haproxy_exporter.

As a matter of policy we do not allow configuration via any sources other than command line flags and configuration files. If you wish to protect passwords, it'd have to be via adding a configuration file to this exporter.

from haproxy_exporter.

I've created an example, you can download a docker image via omskauz/haproxy-exporter:master.

What's the rationale behind your company's policy?

from haproxy_exporter.

Configuration management is the role of your configuration management system, not Prometheus, and in addition environment variables are not a secure way to work with secrets.

from haproxy_exporter.

Environment variables are better than command line flags though.

from haproxy_exporter.

That's your opinion, but it's not the way we decided to go. The fewer ways there are to configure something, the easier it is to operate.

from haproxy_exporter.

This is not an opinion but a fact, that the linux kernel handles command line arguments and environment variables differently:
$ ls -l /proc/1/environ /proc/1/cmdline
-r--r--r-- 1 root root 0 Mar 13 16:23 /proc/1/cmdline
-r-------- 1 root root 0 Mar 14 10:40 /proc/1/environ
Every user can read out a username:password supplied via haproxy-scrape-uri command line argument, but only the process owner can read out the environment variables of a process.

from haproxy_exporter.

I did not say that the environment was less secure than command lines, I said that it was less secure than files.

from haproxy_exporter.

Great, we're on the same page here! If haproxy_exporter supported setting the scrape URI via an environment variable, you could use docker to secure the value via an envivronment file:

$ docker run --help
[...]
      --env-file list                  Read in a file of environment variables
[...]

https://docs.docker.com/compose/env-file/

from haproxy_exporter.

You misunderstand me, environment variables are not secure and we will not be adding support to allow configuration via them. If you this is to be added it needs to come from a configuration file that the haproxy exporter would read.

May I ask why you want auth here? Stats aren't exactly sensitive.

from haproxy_exporter.