Post B5zqrFuPdPwKLu5vtI by cancername@mas.to
 (DIR) More posts by cancername@mas.to
 (DIR) Post #B5xn7B0KqhKbdrHVUO by alina@girldick.gay
       1 likes, 0 repeats
       
       i dont want to leave my prometheus (metrics, not dashboard) endpoints unsecured and i cant decide which layer i should implement it on so i'll just do whatever the result of this poll is gonna be
       
 (DIR) Post #B5xnYMh9UXmJibGzfE by alina@girldick.gay
       1 likes, 0 repeats
       
       @natty what did you do again
       
 (DIR) Post #B5xnhVvcX1FkxfP3R2 by lmke@chaos.social
       0 likes, 0 repeats
       
       @alina I personally prefer OAuth/OIDC on everything because it is so nice to have a central self hosted identity provider coupled with a YubiKey Passkey to sign in everywhere
       
 (DIR) Post #B5xnkEws7PffAUHwLg by ryanc@infosec.exchange
       0 likes, 0 repeats
       
       @alina I don't know what you're working on, but mTLS is a mistake.
       
 (DIR) Post #B5xoCGin7X64m74EhE by alina@girldick.gay
       0 likes, 0 repeats
       
       @ryanc how so?i want to safely scrape prometheus exporters with victoriametrics across the internet and stuff that into grafana without worrying about exposed metrics endpoints
       
 (DIR) Post #B5xoNWnBi3LxnsUbSK by alina@girldick.gay
       0 likes, 0 repeats
       
       @lmke my yubikey or SSO has nothing to do with this setup tho, or at least i wouldn't know how to integrate the comms between prometheus and victoriametrics into the OIDC model here. so this is not about signing into the dashboard but rather restricting the endpoints to be scraped by multiple victoriametrics instances over the internet and no one else
       
 (DIR) Post #B5xogAmnkhv33RCcLY by natty@astolfo.social
       0 likes, 0 repeats
       
       @alina@girldick.gay OAuth2-proxy beforeNow kubernetes RBAC-proxy with cert-manager provisioned mTLS where the X509 CN is the K8s role
       
 (DIR) Post #B5xooPaObuchGwKQSG by natty@astolfo.social
       0 likes, 0 repeats
       
       @alina@girldick.gay the RBAC proxy comes with the Prometheus Operator chart
       
 (DIR) Post #B5xoxo7UlOuhy8I4qe by mentos1386@toot.si
       0 likes, 0 repeats
       
       @alina @lmke I use oidc for s2s communication. It alowes me to issue a service-account for each VM with the required permissions (metrics publisher etc.).Even better is that you can then authenticate with kubernetes service account token (or any other jwt/oidc provider) thing in each pod and exchange that for credentials to publish metrics and what not.
       
 (DIR) Post #B5xp1DoLhVZ6W8xmRE by 4censord@unfug.social
       0 likes, 0 repeats
       
       @alina are you in k8s already? (because there is one option like that)in that case, look at pod certificates, they can be used for mtls and can/are provided to each pod already
       
 (DIR) Post #B5xp1oJ60fYBhvcqMS by natty@astolfo.social
       0 likes, 0 repeats
       
       @4censord@unfug.social @alina@girldick.gay pod certificates are beta :(
       
 (DIR) Post #B5xp569E8OrxuOZqIi by alina@girldick.gay
       0 likes, 0 repeats
       
       @mentos1386 @lmke oh okay that's cool
       
 (DIR) Post #B5xpDvFW1ZuwiIj5Xs by alina@girldick.gay
       0 likes, 0 repeats
       
       @4censord not yet but i have to learn it anyway because of work so why not start now
       
 (DIR) Post #B5xqLuI1Zl5A0aGrMO by ryanc@infosec.exchange
       0 likes, 0 repeats
       
       @alina it's just a massive pain in the arse to work with
       
 (DIR) Post #B5y0dbQZRV70GLLSIC by 4censord@unfug.social
       1 likes, 0 repeats
       
       @natty @alina i have them on the test cluster at work they are great though :/
       
 (DIR) Post #B5zqrFuPdPwKLu5vtI by cancername@mas.to
       0 likes, 0 repeats
       
       @alina http basic auth (serious)