Lets talk about security in Prometheus.
At the moment, Prometheus doesn't offer
any support for authentication
or encryption (TLS) on the server components.
They argue that they are focusing on building
a monitoring solution, and want to avoid
having to implement complex security features.
You can still enable authentication and TLS,
using a reverse proxy, so a third party software
that you put in between them.
Not supporting authentication and encryption,
is only valid for server components.
Prometheus can scrape TLS
and authentication enabled targets.
You can check out the TLS config
in the Prometheus configuration
to configure a CA certificate,
user certificate and user key.
Although, you would still need to setup a reverse proxy
for the targets itself.
So, it's really the server components
that don't include TLS or authentication,
but Prometheus itself can scrape from TLS
over authentication-enabled targets.
So what you need to do if you want to have TLS
is to use a reverse proxy for Prometheus
and for a target that doesn't support TLS.
So in the next demo,
I will show you exactly how you do that.