This message was deleted.

I'm not sure if this is possible. Authenticating with two PuppetDBs using RBAC tokens might be more manageable, if Prometheus supports that?

From a quick skim of the Prometheus docs, it looks like each

scrape_config

can be configured with different credentials --- including TLS certificates. Which makes sense as Prometheus is likely to be monitoring systems that are scattered between different authentication domains.

@Clarkee that works perfectly fine out of the box. Just tell Prometheus which cert comes from which Puppetserver/PuppetDB

Will the Prometheus server be able to use the same Private key for each PE server or will I need to swap agent SSL directories around? or rename directories?

what has the agent to do with this?

Maybe I'm not understanding which certs are used to talk to PuppetDB

whatever certs you configure in the prometheus config 🙂

with

pupperserver ca generate

?

for example, yes