Skip to content

Commit 1de48db

Browse files
committed
Updating docs to adress review
1 parent 82e7fe2 commit 1de48db

1 file changed

Lines changed: 14 additions & 14 deletions

File tree

docs/modules/nifi/pages/usage_guide/monitoring.adoc

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -46,35 +46,40 @@ https://simple-nifi-node-default-0.simple-nifi-node-default.<namespace>.svc.clus
4646
IMPORTANT: If NiFi is configured to do any user authentication, requests to the metric endpoint must be authenticated and authorized.
4747

4848
=== Authentication with NiFi `2.x.x`
49+
50+
[IMPORTANT]
51+
===
52+
The NiFi metrics endpoints are behind a strong authentication mechanism which require credentials for each individual pod.
53+
===
54+
4955
To authenticate, you can use a bearer token created by your NiFi instance e.g.
5056

5157
[source,bash]
5258
----
5359
curl -X POST https://simple-nifi-node-default-0.simple-nifi-node-default.<namespace>.svc.cluster.local:8443/nifi-api/access/token -d 'username=<user>&password=<password>' -k
5460
----
5561

56-
where `-k` equals `verify=false`. The reply is your bearer token.
62+
where `-k` equals `verify=false` to allow self-signed certificates. The reply is your bearer token.
5763

58-
You then can use the bearer token to authenticate with Prometheus replacing `basic_auth` with
64+
The following example shows how to configure the Prometheus scraper to use the bearer token to authenticate against a NiFi pod.
5965

6066
[source,yaml]
6167
----
6268
---
63-
# basic_auth:
64-
# username: <user>
65-
# password: <password>
66-
authorization:
69+
authorization: <1>
6770
type: Bearer
68-
credentials: "<Bearer Token>"
71+
credentials: "<Bearer Token>" <2>
6972
tls_config:
7073
insecure_skip_verify: true
7174
static_configs:
7275
- targets:
73-
- '<pod>.<statefulset>.svc.cluster.local:8443' <1>
76+
- '<pod>.<statefulset>.svc.cluster.local:8443' <3>
7477
metrics_path: '/nifi-api/flow/metrics/prometheus'
7578
scheme: https
7679
----
77-
<1> Static targets only scrapes one pod.
80+
<1> Use the `authorization` property instead if the `basic_auth`.
81+
<2> Add the previously obtained token here.
82+
<3> Static targets only scrapes one pod.
7883

7984
or use it in a NiFi secret which should look like
8085
[source,yaml]
@@ -134,8 +139,3 @@ spec:
134139
<2> Relabel \\__address__ to be a FQDN rather then the IP-Address of target pod
135140

136141
NOTE: As of xref:listener-operator:listener.adoc[Listener] integration, SDP exposes a Service with `-metrics` thus we need to regex this suffix.
137-
138-
==== Known Limitations
139-
140-
NiFi only allows authentication with JWT on pod level. Therefore you will need one endpoint per NiFi pod and a valid bearer token for each. This is a consequence of NiFi
141-
moving their metrics endpoint behind a strong authentication mechanism.

0 commit comments

Comments
 (0)