diff --git a/CHANGELOG.md b/CHANGELOG.md index f969d070692c..20457d0befe8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,8 @@ # Main (unreleased) +- [ENHANCEMENT] Documenting security recommendations for the users used by the embedded exporters, + to give only the strictly necessary roles as per the official docs. + - [BUGFIX] Do not immediately cancel context when creating a new trace processor. This was preventing scrape_configs in traces from functioning. (@lheinlen) diff --git a/docs/configuration/integrations/elasticsearch-exporter-config.md b/docs/configuration/integrations/elasticsearch-exporter-config.md index e435aeca7089..efbe61776d5c 100644 --- a/docs/configuration/integrations/elasticsearch-exporter-config.md +++ b/docs/configuration/integrations/elasticsearch-exporter-config.md @@ -12,6 +12,9 @@ the collection of metrics from ElasticSearch servers. Note that currently, an Agent can only collect metrics from a single ElasticSearch server. However, the exporter is able to collect the metrics from all nodes through that server configured. +We strongly recommend that you configure a separate user for the Agent, and give it only the strictly mandatory +security privileges necessary for monitoring your node, as per the [official documentation](https://github.com/prometheus-community/elasticsearch_exporter#elasticsearch-7x-security-privileges). + Full reference of options: ```yaml diff --git a/docs/configuration/integrations/github-exporter-config.md b/docs/configuration/integrations/github-exporter-config.md index 88075498296e..007e872b3d16 100644 --- a/docs/configuration/integrations/github-exporter-config.md +++ b/docs/configuration/integrations/github-exporter-config.md @@ -8,6 +8,10 @@ The `github_exporter_config` block configures the `github_exporter` integration, which is an embedded version of [`github_exporter`](https://github.com/infinityworks/github-exporter). This allows for the collection of metrics from the github api. +We strongly recommend that you configure a separate authentication token for the Agent, and give it only the strictly mandatory +security privileges necessary for monitoring your repositories, as per the [official documentation](https://docs.github.com/en/rest/reference/permissions-required-for-github-apps). +We also recommend that you use `api_token_file` parameter, to avoid setting the authentication token directly on the Agent config file. + Full reference of options: ```yaml diff --git a/docs/configuration/integrations/kafka-exporter-config.md b/docs/configuration/integrations/kafka-exporter-config.md index 0b59ad138d2a..8c77174dd071 100644 --- a/docs/configuration/integrations/kafka-exporter-config.md +++ b/docs/configuration/integrations/kafka-exporter-config.md @@ -8,6 +8,9 @@ The `kafka_exporter_config` block configures the `kafka_exporter` integration, which is an embedded version of [`kafka_exporter`](https://github.com/davidmparrott/kafka_exporter). This allows for the collection of Kafka Lag metrics and exposing them as Prometheus metrics. +We strongly recommend that you configure a separate user for the Agent, and give it only the strictly mandatory +security privileges necessary for monitoring your node, as per the [documentation](https://github.com/lightbend/kafka-lag-exporter#required-permissions-for-kafka-acl). + Full reference of options: ```yaml diff --git a/docs/configuration/integrations/mongodb_exporter-config.md b/docs/configuration/integrations/mongodb_exporter-config.md index d46c85dee01f..17c584d94a52 100644 --- a/docs/configuration/integrations/mongodb_exporter-config.md +++ b/docs/configuration/integrations/mongodb_exporter-config.md @@ -23,6 +23,9 @@ relabel_configs: replacement: 'prod-cluster' ``` +We strongly recommend that you configure a separate user for the Agent, and give it only the strictly mandatory +security privileges necessary for monitoring your node, as per the [official documentation](https://github.com/percona/mongodb_exporter#permissions). + Besides that, there's not much to configure. Please refer to the full reference of options: ```yaml diff --git a/docs/configuration/integrations/mysqld-exporter-config.md b/docs/configuration/integrations/mysqld-exporter-config.md index cc72bddd3d6d..33b724e7607e 100644 --- a/docs/configuration/integrations/mysqld-exporter-config.md +++ b/docs/configuration/integrations/mysqld-exporter-config.md @@ -24,6 +24,9 @@ mysqld_exporter: replacement: server-a ``` +We strongly recommend that you configure a separate user for the Agent, and give it only the strictly mandatory +security privileges necessary for monitoring your node, as per the [official documentation](https://github.com/prometheus/mysqld_exporter#required-grants). + Full reference of options: ```yaml diff --git a/docs/configuration/integrations/postgres-exporter-config.md b/docs/configuration/integrations/postgres-exporter-config.md index a46a83cda4d0..57995ad1b59d 100644 --- a/docs/configuration/integrations/postgres-exporter-config.md +++ b/docs/configuration/integrations/postgres-exporter-config.md @@ -9,6 +9,9 @@ integration, which is an embedded version of [`postgres_exporter`](https://github.com/prometheus-community/postgres_exporter). This allows for the collection of metrics from Postgres servers. +We strongly recommend that you configure a separate user for the Agent, and give it only the strictly mandatory +security privileges necessary for monitoring your node, as per the [official documentation](https://github.com/prometheus-community/postgres_exporter#running-as-non-superuser). + Full reference of options: ```yaml diff --git a/docs/configuration/integrations/redis-exporter-config.md b/docs/configuration/integrations/redis-exporter-config.md index 7902941df1f3..2e07cc804bf7 100644 --- a/docs/configuration/integrations/redis-exporter-config.md +++ b/docs/configuration/integrations/redis-exporter-config.md @@ -18,6 +18,9 @@ redis_exporter: replacement: redis-2 ``` +We strongly recommend that you configure a separate user for the Agent, and give it only the strictly mandatory +security privileges necessary for monitoring your node, as per the [official documentation](https://github.com/oliver006/redis_exporter#authenticating-with-redis). + Full reference of options: ```yaml # Enables the redis_exporter integration, allowing the Agent to automatically