This message was deleted.
# atlantis-communitys
Slackbot
10/12/2023, 5:35 PMThis message was deleted.
c
Chastity Blackwell
10/12/2023, 5:37 PMWe want to scrape it with prometheus, but we don't really want to try to make IAP work, and I don't know if something like
source_service_accountb
Bruno Schaatsbergen
10/12/2023, 5:38 PMHmm do you mean to make it part of the non IAP protected backend if you’re using IAP? Which is now only exposing /events ?
Bruno Schaatsbergen
10/12/2023, 5:40 PMI’m all for exposing /metrics somehow 👍🏼
Bruno Schaatsbergen
10/12/2023, 5:40 PMWhat kind of solution would you prefer?
c
Chastity Blackwell
10/12/2023, 5:43 PMYeah. I guess I'm not super worried about /metrics being exposed to the world, but I don't know if other folks feel like that's the best plan for achieving that goal. I just want to be able to scrape it with prometheus without having to jump through a lot of hoops.
Chastity Blackwell
10/12/2023, 5:44 PMI'm trying to think of a better solution that would give more options...I guess it could be a switch, so if people didn't want to expose it to the world they could turn it off, but I don't know how many people would actually care.
b
Bruno Schaatsbergen
10/12/2023, 5:45 PMWhere does prom run now?
c
Chastity Blackwell
10/12/2023, 5:45 PMRight now, it's in our k8s cluster.
b
Bruno Schaatsbergen
10/12/2023, 5:45 PMCouldn’t we give the SA associated with prom just an IAM binding so that it could reach the IAP backend?
Bruno Schaatsbergen
10/12/2023, 5:45 PMI would have to test this tbh
Bruno Schaatsbergen
10/12/2023, 5:45 PMBut left or right lets make it work for you!
c
Chastity Blackwell
10/12/2023, 5:45 PMDoes IAP work that way?
Chastity Blackwell
10/12/2023, 5:46 PMI wasn't sure if IAP would do that for a service account.
Chastity Blackwell
10/12/2023, 5:46 PMThat was my first idea, but it doesn't have a workload identity ATM so we'd have to add that, and if it was the only thing 🤷♀️
b
Bruno Schaatsbergen
10/12/2023, 5:47 PMI’m not entirely sure but I would have to double check it
Bruno Schaatsbergen
10/12/2023, 5:47 PMAh ok, if there’s no workload identity yet then it’s going to be tough
c
Chastity Blackwell
10/12/2023, 5:47 PMI mean, we can certainly add one if it's the only way.
b
Bruno Schaatsbergen
10/12/2023, 5:47 PMEven for SaaS solutions that want to scrape /metrics we would need a solution
Bruno Schaatsbergen
10/12/2023, 5:48 PMSo exposing it over the non IAP protected backend is an option
Bruno Schaatsbergen
10/12/2023, 5:48 PMI need to double check what it all exposes and whether it’s safe to do so
c
Chastity Blackwell
10/12/2023, 5:48 PMThat's a good point too.
b
Bruno Schaatsbergen
10/12/2023, 5:48 PMCould you raise an issue for this :)?
c
Chastity Blackwell
10/12/2023, 5:49 PMI sure can!
b
Bruno Schaatsbergen
10/12/2023, 5:51 PMAwesome, thank you — I’ll ensure it gets addressed right after I get back from HashiConf 👍🏼
c
Chastity Blackwell
10/12/2023, 5:51 PMNo problem! Thank you.
Chastity Blackwell
10/12/2023, 5:54 PMChastity Blackwell
10/12/2023, 5:59 PMIt looks like to auth via IAP with a service account it's not exactly a smooth process, unfortunately: https://cloud.google.com/iap/docs/authentication-howto#obtaining_an_oidc_token_in_all_other_cases
b
Bruno Schaatsbergen
10/12/2023, 6:00 PMJust saw that indeed… we still need a solution anyway
c
Chastity Blackwell
10/12/2023, 6:01 PMYup.
b
Bruno Schaatsbergen
10/12/2023, 6:01 PMI can imagine we just add an ‘expose_metrics_publicly’ variable to make this work easy
👍 1
Bruno Schaatsbergen
10/19/2023, 4:43 AM5 Views