Which permissions are needed to fetch metrics from arango?

user_4219512 0
Viewed 70

I want to fetch arangodb metrics with prometheus. Since I enabled authertication this has to be done with an user and password.

What are the required permissions needed for this?

This works so far:

arangosh
const users = require('@arangodb/users');
users.save('prometheus', 'supersecure')
users.grantDatabase("prometheus", "_system", "ro")
users.grantCollection("prometheus", "_system", "*", "none")
arangodb
1 Answers

the last command is not necessary. These are my steps:

  • Create an user prometheus which read-only access to _system as you suggest

  • Create an access token

    require('@arangodb/crypto').jwtEncode(
  "secret_token", {
    "preferred_username": "prometheus", 
    "allowed_paths": ["/_admin/metrics"], 
    "iss": "arangodb", 
    "exp": Math.floor(Date.now() / 1000) + 31536000 }, 
  "HS256");

    where secret_token is the super-user token and 31536000 is the time to live in seconds in this case roughly a year.

This token will grant access to the /_admin/metrics API like so:

curl -H"Authorization: bearer $TOKEN" https://instance-ip:port/_admin/metrics
user_59093880
Related