where can i specify credentials for elasticsearch exporter

[tabbi]

Hello, i have Elasticsearch cluster with Internode TLS Enabled, so i have users in Elasticsearch, and i'm use the exporter running on my system as systemD daemon, so here is my systemD unit file

[Unit]
Description=Elasticsearch Exporter
After=network.target
[Service]
ExecStart=/opt/prometheus-exporters/elasticsearch-exporter/elasticsearch_exporter \
        --es.uri http://127.0.0.1:9200/ \\
        --es.timeout 5s \\
        --web.listen-address :9108 \\
        --web.telemetry-path /metrics \\
         --es.ca /etc/elasticsearch/certs/kei.p12 \\
[Install]
WantedBy=multi-user.target

and according to documentation i can't find where i can specify credentials

[ebuildy]

See #404

[adammike]

You can specify the credentials in the url, ***@***.*** works. One downside is that the helm chart sets that environment variable directly in the pod spec, rather than mounting it as a secret, so it’s there for everyone to see when you kubectl describe pod.

…

-Mike From: Thomas Decaux ***@***.***> Sent: Monday, June 14, 2021 11:52 PM To: prometheus-community/elasticsearch_exporter ***@***.***> Cc: Subscribed ***@***.***> Subject: [EXTERNAL] Re: [prometheus-community/elasticsearch_exporter] where can i specify credentials for elasticsearch exporter (#438) Not sure this is supported, this exporter use basic golang http and I dont see any reference to authentication in the code. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub ZjQcmQRYFpfptBannerStart This Message Is From an External Sender This message came from outside your organization. ZjQcmQRYFpfptBannerEnd Not sure this is supported, this exporter use basic golang http and I dont see any reference to authentication in the code. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub<#438 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ALVAJXBACYXJWYOJ2XXDBSTTS32BVANCNFSM46WNRUZQ>.

[tabbi]

@adammike Hi! so i can do this like that?
--es.uri http://elastic:123453@192.168.2.11:9200/ right?

[noxiii]

Hey,
thank you this helps me for the moment too.
But this isn't really secure. The Password is displayed the in the process overview.
Is there an option to invisiable the password if I run this via systemd. e.g. to seperate into a config file.

[ebuildy]

A PR will be welcomed :-) I could do it in a few days if you want Le mer. 16 juin 2021 à 15:56, noxiii ***@***.***> a écrit :

…

Hey, thank you this helps me for the moment too. But this isn't really secure. The Password is displayed the in the process overview. Is there an option to invisiable the password if I run this via systemd. e.g. to seperate into a config file. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#438 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAJJZ2M625TADB5ANHEJ5QLTTCUPPANCNFSM46WNRUZQ> .

[adammike]

@adammike Hi! so i can do this like that?
--es.uri http://elastic:123453@192.168.2.11:9200/ right?

yes

[m4r1u2]

In the Helm you can achieve this by combinding a secret and envFromSecret.
Then use the env mapped from the secret in the uri like this:

values.yaml

envFromSecret: elasticsearch-pwd
es:
  uri:  https://$(ES_USERNAME):$(ES_PASSWORD)@url-to-es

[neuroid]

Since options can also be set as environment variables, you could put ES_URI in your unit's Environment or EnvironmentFile, instead of specifying --es.uri.

[noxiii]

To tabbi systemd example above. I load now the parameter with EnvironmentFile into systemd. This works very good and the credentials doesn't show in the process list.

My config looks like: /etc/prometheus/elasticsearch-exporter.conf

# Configuration for the prometheus elasticsearch exporter
ES_URI=https://prometheus:password@localhost:9200
WEB_LISTEN_ADDRESS=:9114
ES_ALL=true
ES_INDICES=true

and the systemd config: /etc/systemd/system/elasticsearch-exporter.conf

[Unit]
Description=Elasticsearch Exporter

[Service]
EnvironmentFile=/etc/prometheus/prometheus-elasticsearch-exporter.conf
ExecStart=/usr/local/bin/prometheus-elasticsearch-exporter

[Install]
WantedBy=multi-user.target

[guillaumelecerf]

Maybe #461 could be helpful.

[sysadmind]

As mentioned, #461 has added support for the credentials as environment variables. If this doesn't solve your needs, please feel free to open a new issue.