Skip to content

Commit 97177d7

Browse files
felladrinfelladrin
authored
feat: add Prometheus metrics support (#768)
1 parent 10f3acf commit 97177d7

13 files changed

+1214
-8
lines changed

‎docs/data-sources/prometheus_scrape_config.md‎

Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
---
2+
page_title: "minio_prometheus_scrape_config Data Source - terraform-provider-minio"
3+
subcategory: ""
4+
description: |-
5+
Generates Prometheus scrape configuration for MinIO metrics endpoints.
6+
---
7+
8+
# minio_prometheus_scrape_config (Data Source)
9+
10+
Generates Prometheus scrape configuration for MinIO metrics endpoints.
11+
12+
## Example Usage
13+
14+
```terraform
15+
# Generate scrape configuration for cluster metrics
16+
data "minio_prometheus_scrape_config" "cluster" {
17+
metric_type = "cluster"
18+
alias = "minio-cluster"
19+
}
20+
21+
# Generate scrape configuration for node metrics
22+
data "minio_prometheus_scrape_config" "node" {
23+
metric_type = "node"
24+
alias = "minio-nodes"
25+
}
26+
27+
# Generate scrape configuration for bucket metrics with v2 metrics
28+
data "minio_prometheus_scrape_config" "bucket" {
29+
metric_type = "bucket"
30+
alias = "minio-buckets"
31+
metrics_version = "v2"
32+
}
33+
34+
# Generate scrape configuration for resource metrics with bearer token
35+
data "minio_prometheus_scrape_config" "resource" {
36+
metric_type = "resource"
37+
alias = "minio-resources"
38+
bearer_token = "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9..."
39+
}
40+
```
41+
42+
## Using with Bearer Token Resource
43+
44+
```terraform
45+
# Create a bearer token for authenticated access
46+
resource "minio_prometheus_bearer_token" "cluster_token" {
47+
metric_type = "cluster"
48+
expires_in = "24h"
49+
}
50+
51+
# Generate authenticated scrape configuration
52+
data "minio_prometheus_scrape_config" "cluster_auth" {
53+
metric_type = "cluster"
54+
alias = "minio-cluster-auth"
55+
bearer_token = minio_prometheus_bearer_token.cluster_token.token
56+
}
57+
58+
# Output the complete Prometheus configuration
59+
output "prometheus_config" {
60+
value = data.minio_prometheus_scrape_config.cluster_auth.scrape_config
61+
}
62+
```
63+
64+
## Complete Prometheus Configuration Example
65+
66+
```terraform
67+
# Generate scrape configs for all metric types
68+
data "minio_prometheus_scrape_config" "cluster" {
69+
metric_type = "cluster"
70+
alias = "minio-cluster"
71+
}
72+
73+
data "minio_prometheus_scrape_config" "node" {
74+
metric_type = "node"
75+
alias = "minio-nodes"
76+
}
77+
78+
data "minio_prometheus_scrape_config" "bucket" {
79+
metric_type = "bucket"
80+
alias = "minio-buckets"
81+
}
82+
83+
data "minio_prometheus_scrape_config" "resource" {
84+
metric_type = "resource"
85+
alias = "minio-resources"
86+
}
87+
88+
# Combine all scrape configs
89+
locals {
90+
prometheus_config = <<-EOT
91+
${data.minio_prometheus_scrape_config.cluster.scrape_config}
92+
93+
${data.minio_prometheus_scrape_config.node.scrape_config}
94+
95+
${data.minio_prometheus_scrape_config.bucket.scrape_config}
96+
97+
${data.minio_prometheus_scrape_config.resource.scrape_config}
98+
EOT
99+
}
100+
101+
output "complete_prometheus_config" {
102+
value = local.prometheus_config
103+
}
104+
```
105+
106+
<!-- schema generated by tfplugindocs -->
107+
## Schema
108+
109+
### Required
110+
111+
- `metric_type` (String) Metric type for the scrape configuration. Valid values are: cluster, node, bucket, resource
112+
113+
### Optional
114+
115+
- `alias` (String) Alias for the MinIO server in Prometheus configuration
116+
- `bearer_token` (String, Sensitive) Bearer token for authenticated access to Prometheus metrics (when using JWT auth)
117+
- `metrics_version` (String) Metrics version. Valid values are: v2, v3
118+
119+
### Read-Only
120+
121+
- `id` (String) The ID of this resource.
122+
- `metrics_path` (String) Metrics endpoint path
123+
- `scrape_config` (String, Sensitive) Generated Prometheus scrape configuration in YAML format
124+
125+
## Metric Types
126+
127+
- **cluster**: Cluster-level metrics including server status, usage, and performance
128+
- **node**: Node-specific metrics for individual MinIO servers in a cluster
129+
- **bucket**: Bucket-level metrics including object counts, sizes, and operations
130+
- **resource**: Resource utilization metrics for CPU, memory, and disk
131+
132+
## Metrics Versions
133+
134+
- **v2**: Legacy metrics format (`/minio/v2/metrics/{type}`)
135+
- **v3**: Current metrics format (`/minio/metrics/v3?type={type}`) - default
136+
137+
## Authentication
138+
139+
The data source supports both unauthenticated and authenticated access:
140+
141+
1. **Unauthenticated**: Omit the `bearer_token` field for public metrics endpoints
142+
2. **Authenticated**: Provide a JWT bearer token for secure metrics access
143+
144+
Use the `minio_prometheus_bearer_token` resource to generate valid tokens.
145+
146+
## Generated Configuration
147+
148+
The generated scrape configuration includes:
149+
150+
- Job name based on the alias
151+
- Metrics path for the specified metric type and version
152+
- Scheme (http/https) based on provider SSL configuration
153+
- Bearer token (if provided)
154+
- Static config with the MinIO server endpoint
155+
156+
Example output:
157+
```yaml
158+
scrape_configs:
159+
- job_name: minio-cluster
160+
metrics_path: /minio/metrics/v3?type=cluster
161+
scheme: https
162+
bearer_token: eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9...
163+
static_configs:
164+
- targets: ["minio.example.com:9000"]
165+
```

‎docs/resources/prometheus_bearer_token.md‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
---
2+
page_title: "minio_prometheus_bearer_token Resource - terraform-provider-minio"
3+
subcategory: ""
4+
description: |-
5+
Manages MinIO Prometheus bearer tokens for metrics authentication.
6+
Bearer tokens are JWTs signed with MinIO credentials that authenticate
7+
requests to Prometheus metrics endpoints. Each metric type (cluster, node,
8+
bucket, resource) can have its own token.
9+
Tokens are generated locally using the provider's access and secret keys,
10+
so no API call is needed to create them. The token is valid for the specified
11+
duration from creation time.
12+
---
13+
14+
# minio_prometheus_bearer_token (Resource)
15+
16+
Manages MinIO Prometheus bearer tokens for metrics authentication.
17+
18+
Bearer tokens are JWTs signed with MinIO credentials that authenticate
19+
requests to Prometheus metrics endpoints. Each metric type (cluster, node,
20+
bucket, resource) can have its own token.
21+
22+
Tokens are generated locally using the provider's access and secret keys,
23+
so no API call is needed to create them. The token is valid for the specified
24+
duration from creation time.
25+
26+
## Example Usage
27+
28+
```terraform
29+
# Create a bearer token for cluster metrics
30+
resource "minio_prometheus_bearer_token" "cluster" {
31+
metric_type = "cluster"
32+
expires_in = "24h"
33+
}
34+
35+
# Create a bearer token for node metrics with custom expiry
36+
resource "minio_prometheus_bearer_token" "node" {
37+
metric_type = "node"
38+
expires_in = "168h" # 1 week
39+
}
40+
41+
# Create a bearer token for bucket metrics with limit
42+
resource "minio_prometheus_bearer_token" "bucket" {
43+
metric_type = "bucket"
44+
expires_in = "720h" # 30 days
45+
limit = 2160 # 90 days limit
46+
}
47+
48+
# Create a bearer token for resource metrics
49+
resource "minio_prometheus_bearer_token" "resource" {
50+
metric_type = "resource"
51+
expires_in = "87600h" # 10 years (default)
52+
}
53+
```
54+
55+
## Using with Prometheus Scrape Configuration
56+
57+
```terraform
58+
# Generate bearer token
59+
resource "minio_prometheus_bearer_token" "cluster_metrics" {
60+
metric_type = "cluster"
61+
expires_in = "24h"
62+
}
63+
64+
# Generate scrape configuration with bearer token
65+
data "minio_prometheus_scrape_config" "cluster" {
66+
metric_type = "cluster"
67+
bearer_token = minio_prometheus_bearer_token.cluster_metrics.token
68+
}
69+
70+
output "prometheus_scrape_config" {
71+
value = data.minio_prometheus_scrape_config.cluster.scrape_config
72+
}
73+
```
74+
75+
<!-- schema generated by tfplugindocs -->
76+
## Schema
77+
78+
### Required
79+
80+
- `metric_type` (String) Type of metrics to authenticate. Valid values: cluster, node, bucket, resource
81+
82+
### Optional
83+
84+
- `expires_in` (String) Token expiry duration in whole hours only (e.g., 24h, 87600h). Go time.Duration formats like 24h30m or units such as m/s are not supported. Default: 87600h (10 years)
85+
- `limit` (Number) Maximum token expiry in hours. Default: 876000 (100 years)
86+
87+
### Read-Only
88+
89+
- `id` (String) The ID of this resource.
90+
- `token` (String, Sensitive) Generated JWT bearer token for the metrics endpoint
91+
- `token_expiry` (String) Expiry timestamp of the token in RFC3339 format
92+
93+
## Import
94+
95+
Import is supported using the following syntax:
96+
97+
```shell
98+
# Import using the metric type
99+
terraform import minio_prometheus_bearer_token.example cluster
100+
terraform import minio_prometheus_bearer_token.example node
101+
terraform import minio_prometheus_bearer_token.example bucket
102+
terraform import minio_prometheus_bearer_token.example resource
103+
```
104+
105+
## Security Considerations
106+
107+
- Bearer tokens are sensitive credentials. Treat them like passwords.
108+
- Tokens are generated locally using the provider's access and secret keys.
109+
- The token is stored in Terraform state as a sensitive value.
110+
- Use appropriate expiry durations based on your security requirements.
111+
- Regularly rotate tokens by updating the `expires_in` field.
112+
113+
## Token Expiry
114+
115+
- The `expires_in` field accepts durations in whole hours only (e.g., `24h`, `168h`).
116+
- The `limit` field sets the maximum allowed expiry in hours.
117+
- If the requested expiry exceeds the limit, it will be capped at the limit.
118+
- Default expiry is 87600 hours (10 years).
119+
- Default limit is 876000 hours (100 years).

‎minio/check_config.go‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -297,3 +297,38 @@ func ObjectLegalHoldConfig(d *schema.ResourceData, meta interface{}) *S3MinioObj
297297
MinioStatus: getOptionalField(d, "status", "").(string),
298298
}
299299
}
300+
301+
// PrometheusBearerTokenConfig creates configuration for MinIO Prometheus bearer token.
302+
func PrometheusBearerTokenConfig(d *schema.ResourceData, meta interface{}) *S3MinioPrometheusBearerToken {
303+
m := meta.(*S3MinioClient)
304+
305+
return &S3MinioPrometheusBearerToken{
306+
MinioAdmin: m.S3Admin,
307+
MinioAccessKey: m.S3UserAccess,
308+
MinioSecretKey: m.S3UserSecret,
309+
MetricType: getOptionalField(d, "metric_type", "cluster").(string),
310+
ExpiresIn: getOptionalField(d, "expires_in", "87600h").(string),
311+
Limit: getOptionalField(d, "limit", 876000).(int),
312+
}
313+
}
314+
315+
// PrometheusScrapeConfig creates configuration for MinIO Prometheus scrape config.
316+
func PrometheusScrapeConfig(d *schema.ResourceData, meta interface{}) *S3MinioPrometheusScrapeConfig {
317+
m := meta.(*S3MinioClient)
318+
319+
payload := &S3MinioPrometheusScrapeConfig{
320+
MinioEndpoint: m.S3Endpoint,
321+
MinioAccessKey: m.S3UserAccess,
322+
MinioSecretKey: m.S3UserSecret,
323+
UseSSL: m.S3SSL,
324+
MetricType: getOptionalField(d, "metric_type", "cluster").(string),
325+
Alias: getOptionalField(d, "alias", "").(string),
326+
MetricsVersion: getOptionalField(d, "metrics_version", "v3").(string),
327+
}
328+
329+
if val, ok := d.GetOk("bearer_token"); ok {
330+
payload.BearerToken = val.(string)
331+
}
332+
333+
return payload
334+
}

0 commit comments

Comments
 (0)