From 34765e9215f8a0f1476b09993a0703c38a691e4b Mon Sep 17 00:00:00 2001 From: Patrick Seidensal Date: Tue, 5 May 2020 14:16:36 +0200 Subject: [PATCH] mgr/dashboard: document Prometheus' security model Fixes: https://tracker.ceph.com/issues/45377 Signed-off-by: Patrick Seidensal --- doc/cephadm/monitoring.rst | 29 ++++++++++++++++++++++++----- doc/mgr/dashboard.rst | 34 ++++++++++++++++++++++++++++++---- 2 files changed, 54 insertions(+), 9 deletions(-) diff --git a/doc/cephadm/monitoring.rst b/doc/cephadm/monitoring.rst index 57994910308..213ff588836 100644 --- a/doc/cephadm/monitoring.rst +++ b/doc/cephadm/monitoring.rst @@ -1,9 +1,9 @@ Monitoring Stack with Cephadm ============================= -The Ceph dashboard makes use of prometheus, grafana, and related tools -to store and visualize detailed metrics on cluster utilization and -performance. Ceph users have three options: +Ceph Dashboard uses `Prometheus `_, `Grafana +`_, and related tools to store and visualize detailed +metrics on cluster utilization and performance. Ceph users have three options: #. Have cephadm deploy and configure these services. This is the default when bootstrapping a new cluster unless the ``--skip-monitoring-stack`` @@ -14,8 +14,27 @@ performance. Ceph users have three options: #. Skip the monitoring stack completely. Some Ceph dashboard graphs will not be available. -Deploying monitoring with cephadm ---------------------------------- +The monitoring stack consists of `Prometheus `_, +Prometheus exporters (:ref:`mgr-prometheus`, `Node exporter +`_), `Prometheus Alert +Manager `_ and `Grafana +`_. + +.. note:: + + Prometheus' security model presumes that untrusted users have access to the + Prometheus HTTP endpoint and logs. Untrusted users have access to all the + (meta)data Prometheus collects that is contained in the database, plus a + variety of operational and debugging information. + + However, Prometheus' HTTP API is limited to read-only operations. + Configurations can *not* be changed using the API and secrets are not + exposed. Moreover, Prometheus has some built-in measures to mitigate the + impact of denial of service attacks. + + Please see `Prometheus' Security model + ` for more detailed + information. By default, bootstrap will deploy a basic monitoring stack. If you did not do this (by passing ``--skip-monitoring-stack``, or if you diff --git a/doc/mgr/dashboard.rst b/doc/mgr/dashboard.rst index 5d9cc86f5b2..2a354f55ca9 100644 --- a/doc/mgr/dashboard.rst +++ b/doc/mgr/dashboard.rst @@ -65,10 +65,9 @@ aspects of your Ceph cluster: * **Overall cluster health**: Display overall cluster status, performance and capacity metrics. * **Embedded Grafana Dashboards**: Ceph Dashboard is capable of embedding - `Grafana `_ dashboards in many locations, to display - additional information and performance metrics gathered by the - :ref:`mgr-prometheus`. See :ref:`dashboard-grafana` for details on how to - configure this functionality. + `Grafana`_ dashboards in many locations, to display additional information + and performance metrics gathered by the :ref:`mgr-prometheus`. See + :ref:`dashboard-grafana` for details on how to configure this functionality. * **Cluster logs**: Display the latest updates to the cluster's event and audit log files. Log entries can be filtered by priority, date or keyword. * **Hosts**: Display a list of all hosts associated to the cluster, which @@ -378,6 +377,31 @@ The available iSCSI gateways must be defined using the following commands:: Enabling the Embedding of Grafana Dashboards ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +`Grafana`_ requires data from `Prometheus `_. Although +Grafana can use other data sources, the Grafana dashboards we provide contain +queries that are specific to Prometheus. Our Grafana dashboards therefore +require Prometheus as the data source. The Ceph :ref:`mgr-prometheus` also only +exports its data in the Prometheus' common format. The Grafana dashboards rely +on metric names from the Prometheus module and `Node exporter +`_. The Node exporter is a +separate application that provides machine metrics. + +.. note:: + + Prometheus' security model presumes that untrusted users have access to the + Prometheus HTTP endpoint and logs. Untrusted users have access to all the + (meta)data Prometheus collects that is contained in the database, plus a + variety of operational and debugging information. + + However, Prometheus' HTTP API is limited to read-only operations. + Configurations can *not* be changed using the API and secrets are not + exposed. Moreover, Prometheus has some built-in measures to mitigate the + impact of denial of service attacks. + + Please see `Prometheus' Security model + ` for more detailed + information. + Grafana and Prometheus are likely going to be bundled and installed by some orchestration tools along Ceph in the near future, but currently, you will have to install and configure both manually. After you have installed Prometheus and @@ -1068,5 +1092,7 @@ Plug-ins Dashboard Plug-ins extend the functionality of the dashboard in a modular and loosely coupled fashion. +.. _Grafana: https://grafana.com/ + .. include:: dashboard_plugins/feature_toggles.inc.rst .. include:: dashboard_plugins/debug.inc.rst -- 2.39.5