Metrics endpoint to support TLS

Hello! We’ve some requirements to expose metrics in an TLS endpoint. Simple HttpServer added this constructor in 0.7.0 to allow https server to be passed.

If we add conf to specify keystore and other related configs, we can create an HttpsServer in JavaAgent.

I’ve made it work here - https://github.com/senthilkumarkj/jmx_exporter/pull/1

However, I’m not sure what’s the best way to add the new configs for the server. Currently server related conf (host and port) are part of options itself.

I’ve a couple of proposals.

1. Add the new configs (such as TLSEnabled, Keystore path, password etc) in the same config file separated by yaml directive --- and config names prefixed with “server” like

---
serverTLSEnabled: true
serverKeyStorePath: <path>
serverKeyStorePassword: secret

But the problem is config file is parsed in collector only. We may need to parse the same file twice one in agent and one in collector.

1. Add a new server config file. This is what I’ve done in my CL. But I need to make sure if the server config isn’t given, agent should still work and shouldn’t complain to be backward compatible.

Please let me know your thoughts on this. Thanks!

[al-bar]

Hi all, I’d like to add to this discussion the request to consider adding also authentication to TLS support. The only solution I’ve found at the moment to fulfill the requirement to enrcrypt and authenticate the exposed metrics is to add a proxy in front of the jmx_exporter http interface to authenticate and add TLS, but I definitely need a lighter solution.

[dhoard]

@suyuyi Currently, using a reverse proxy with TLS/SSL is required. I have worked on some of the initial work for the feature, but I’m currently focused on other things, so haven’t revisited it.