mgr/dashboard: add ssl verify option for prometheus and alert manager

Fixes: https://tracker.ceph.com/issues/47863
Signed-off-by: Jean "henyxia" Wasilewski <henyxia@revs0.com>

diff --git a/doc/mgr/dashboard.rst b/doc/mgr/dashboard.rst
index cfa5454f0d6347df47537b7aff6326b6a00442b2..2565138f292c0a3b3871896d78344f7d505a4232 100644 (file)
--- a/doc/mgr/dashboard.rst
+++ b/doc/mgr/dashboard.rst
@@ -760,6 +760,19 @@ in order to manage silences.
   should not disturb each other through annoying duplicated notifications
   popping up.
 
+If you are using a self-signed certificate in your Prometheus or your
+Alertmanager setup, you should disable certificate verification in the
+dashboard to avoid refused connections, e.g. caused by certificates signed by
+unknown CA or not matching the host name.
+
+- For Prometheus::
+
+  $ ceph dashboard set-prometheus-api-ssl-verify False
+
+- For Alertmanager::
+
+  $ ceph dashboard set-alertmanager-api-ssl-verify False
+
 .. _dashboard-user-role-management:
 
 User and Role Management

diff --git a/src/pybind/mgr/dashboard/controllers/prometheus.py b/src/pybind/mgr/dashboard/controllers/prometheus.py
index a1e793913aeab051303773fd221bff451e60c79b..09aa42663179bddda4a1a7e1ed4d178b1ee60d0e 100644 (file)
--- a/src/pybind/mgr/dashboard/controllers/prometheus.py
+++ b/src/pybind/mgr/dashboard/controllers/prometheus.py
@@ -30,20 +30,23 @@ class PrometheusRESTController(RESTController):
     def prometheus_proxy(self, method, path, params=None, payload=None):
         # type (str, str, dict, dict)
         return self._proxy(self._get_api_url(Settings.PROMETHEUS_API_HOST),
-                           method, path, 'Prometheus', params, payload)
+                           method, path, 'Prometheus', params, payload,
+                           verify=Settings.PROMETHEUS_API_SSL_VERIFY)
 
     def alert_proxy(self, method, path, params=None, payload=None):
         # type (str, str, dict, dict)
         return self._proxy(self._get_api_url(Settings.ALERTMANAGER_API_HOST),
-                           method, path, 'Alertmanager', params, payload)
+                           method, path, 'Alertmanager', params, payload,
+                           verify=Settings.ALERTMANAGER_API_SSL_VERIFY)
 
     def _get_api_url(self, host):
         return host.rstrip('/') + '/api/v1'
 
-    def _proxy(self, base_url, method, path, api_name, params=None, payload=None):
-        # type (str, str, str, str, dict, dict)
+    def _proxy(self, base_url, method, path, api_name, params=None, payload=None, verify=True):
+        # type (str, str, str, str, dict, dict, bool)
         try:
-            response = requests.request(method, base_url + path, params=params, json=payload)
+            response = requests.request(method, base_url + path, params=params,
+                                        json=payload, verify=verify)
         except Exception:
             raise DashboardException(
                 "Could not reach {}'s API on {}".format(api_name, base_url),

diff --git a/src/pybind/mgr/dashboard/settings.py b/src/pybind/mgr/dashboard/settings.py
index c9c3448597470da7f36d70d3ef70e64316118981..e4f0fad03fc2378a53e8520da905e6a438954e3c 100644 (file)
--- a/src/pybind/mgr/dashboard/settings.py
+++ b/src/pybind/mgr/dashboard/settings.py
@@ -46,7 +46,9 @@ class Options(object):
 
     # Prometheus settings
     PROMETHEUS_API_HOST = ('', str)
+    PROMETHEUS_API_SSL_VERIFY = (True, bool)
     ALERTMANAGER_API_HOST = ('', str)
+    ALERTMANAGER_API_SSL_VERIFY = (True, bool)
 
     # iSCSI management settings
     ISCSI_API_SSL_VERIFICATION = (True, bool)

diff --git a/src/pybind/mgr/dashboard/tests/test_prometheus.py b/src/pybind/mgr/dashboard/tests/test_prometheus.py
index 3b84f0e0044eec86d0167efcba983e1eb9601017..14b2dca9ba2521e2c8bbe5b52c36fb518b300423 100644 (file)
--- a/src/pybind/mgr/dashboard/tests/test_prometheus.py
+++ b/src/pybind/mgr/dashboard/tests/test_prometheus.py
@@ -32,37 +32,39 @@ class PrometheusControllerTest(ControllerTestCase):
         with patch('requests.request') as mock_request:
             self._get('/api/prometheus/rules')
             mock_request.assert_called_with('GET', self.prometheus_host_api + '/rules',
-                                            json=None, params={})
+                                            json=None, params={}, verify=True)
 
     def test_list(self):
         with patch('requests.request') as mock_request:
             self._get('/api/prometheus')
             mock_request.assert_called_with('GET', self.alert_host_api + '/alerts',
-                                            json=None, params={})
+                                            json=None, params={}, verify=True)
 
     def test_get_silences(self):
         with patch('requests.request') as mock_request:
             self._get('/api/prometheus/silences')
             mock_request.assert_called_with('GET', self.alert_host_api + '/silences',
-                                            json=None, params={})
+                                            json=None, params={}, verify=True)
 
     def test_add_silence(self):
         with patch('requests.request') as mock_request:
             self._post('/api/prometheus/silence', {'id': 'new-silence'})
             mock_request.assert_called_with('POST', self.alert_host_api + '/silences',
-                                            params=None, json={'id': 'new-silence'})
+                                            params=None, json={'id': 'new-silence'},
+                                            verify=True)
 
     def test_update_silence(self):
         with patch('requests.request') as mock_request:
             self._post('/api/prometheus/silence', {'id': 'update-silence'})
             mock_request.assert_called_with('POST', self.alert_host_api + '/silences',
-                                            params=None, json={'id': 'update-silence'})
+                                            params=None, json={'id': 'update-silence'},
+                                            verify=True)
 
     def test_expire_silence(self):
         with patch('requests.request') as mock_request:
             self._delete('/api/prometheus/silence/0')
             mock_request.assert_called_with('DELETE', self.alert_host_api + '/silence/0',
-                                            json=None, params=None)
+                                            json=None, params=None, verify=True)
 
     def test_silences_empty_delete(self):
         with patch('requests.request') as mock_request: