Support path exclusion from basic authentication

[heylongdacoder]

Fixes: prometheus/prometheus#9166

Signed-off-by: heylongdacoder [email protected]

[heylongdacoder]

This PR is based on some of the comment from #70

[roidelapluie]

Can we make the parameter more generic and also skip TLS cert validation?

[heylongdacoder]

@roidelapluie hello, I got two questions:

1. May I know what do you mean by make the parameter more generic?
2. Regarding the skip TLS cert validation, you mean when user config client_auth_type as RequireAndVerifyClientCert, but they want Prometheus server to skip the TLS client cert validation only for certain endpoints?

Thanks in advance. :D

[roidelapluie]

The use case for this is that you can serve /-/health without TLS authentication but the rest with authentication because kube probes do not support certs

[SuperQ]

This needs a rebase.

[heylongdacoder]

The use case for this is that you can serve /-/health without TLS authentication but the rest with authentication because kube probes do not support certs

Got it! Let me check how to do this. Thanks :D

[SiiiiiiD]

Any chance get this merged?

Or, maybe, someone can recommend any workarounds for keeping health check works with mTLS/auth added to prometheus and/or some sensitive exporters?

Even switching health checks to exec of custom wget or curl is not possible in a straight way, since since busybox based images wget not able to handle client certs, while curl is missing at all (this approach also potentially may spawn zombie processes within containers).

[rzetelskik]

@roidelapluie @SuperQ are you accepting contributions for this issue? Seems like this particular PR lost traction.

[rzetelskik]

To follow up, I'm particularly interested in being able to skip mTLS for /-/healthy and /-/ready endpoints with "RequireAndVerifyClientCert" due to kubelet probes not supporting certificates (see comments above and prometheus-operator/prometheus-operator#5419). I'd be happy to contribute that part. @roidelapluie did you guys put any thought into how you'd want this implemented?

[heylongdacoder]

skip TLS for /-/healthy and /-/ready endpoints with "RequireAndVerifyClientCert"

Hi @rzetelskik, as you may know, this is the part that missing in my PR. I have gone through the HTTP server code a bit regarding this but got no idea how to implement this at this moment. And currently I am busy with my personal life. Please feel free to take this issue 😄