Skip to content

prometheus canary mTLS #509

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
adityathebe merged 1 commit into from
May 21, 2026
Merged

prometheus canary mTLS #509

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 56 additions & 6 deletions canary-checker/docs/reference/1-prometheus.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,10 +40,53 @@ The Prometheus Check connects to the Prometheus host, performs the desired query
description: 'Bearer token to use for authentication',
scheme: 'EnvVar'
},
{ field: 'oauth', scheme: '[OAuth](#oauth)' }
{ field: 'oauth', scheme: '[OAuth](#oauth)' },
{
field: 'tls',
description: 'TLS and mutual TLS configuration',
scheme: '[TLSConfig](#tls-config)'
}
]}
/>

## TLS Config

Use `tls.ca` to verify Prometheus with a custom CA. Add `tls.cert` and `tls.key` for mutual TLS.

<Fields
rows={[
{
field: 'ca',
description:
'PEM encoded CA certificate to verify the Prometheus server certificate',
scheme: 'EnvVar'
},
{
field: 'cert',
description: 'PEM encoded client certificate',
scheme: 'EnvVar'
},
{
field: 'key',
description: 'PEM encoded client private key',
scheme: 'EnvVar'
},
{
field: 'handshakeTimeout',
description: 'TLS handshake timeout. Defaults to 10 seconds',
scheme: 'Duration'
},
{
field: 'insecureSkipVerify',
description:
'Skip verification of the server certificate chain and host name',
scheme: 'bool'
}
]}
/>



## OAuth

<Fields
Expand All @@ -62,21 +105,28 @@ The Prometheus Check connects to the Prometheus host, performs the desired query

## Result Variables

| Name | Description | Scheme |
| ------------ | ----------------------- | --------------------------- |
| `value` | | _float_ |
| `firstValue` | Number of rows returned | _int_ |
| Name | Description | Scheme |
| ------------ | ----------------------- | -------------------------- |
| `value` | | _float_ |

@coderabbitai coderabbitai Bot May 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Add description for the value field.

The value field has an empty description column. Users need to understand what this field represents.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@canary-checker/docs/reference/1-prometheus.mdx` at line 110, The table row
for the `value` field is missing a description: update the `value` column to
explain that `value` is the numeric sample for the Prometheus time series (a
floating‑point metric measurement at the given timestamp), include units or
scale if applicable, and note any special cases (e.g., NaN/Inf handling or when
the field may be null) so readers understand what the `_float_` represents.

| `firstValue` | Number of rows returned | _int_ |
| `results` | A list of results | _[]map[string]interface{}_ |


## Examples

### Create a check per prometheus job using a transform

```yaml title="jobs.yaml" file=<rootDir>/modules/canary-checker/fixtures/prometheus/jobs.yaml

```

### Create a check per failing job only

```yaml title="jobs.yaml" file=<rootDir>/modules/canary-checker/fixtures/prometheus/jobs-fail-only.yaml

```

### Prometheus with mutual TLS

```yaml title="prometheus-mtls.yaml" file=<rootDir>/modules/canary-checker/fixtures/datasources/prometheus_mtls.yaml

```
2 changes: 1 addition & 1 deletion mission-control-chart
Open in desktop
Submodule mission-control-chart updated 19 files
+1 −1 Makefile
+2 −2 agent-chart/Chart.yaml
+1 −1 agent-chart/values.schema.json
+1 −1 agent-chart/values.yaml
+3 −3 chart/Chart.yaml
+26 −0 chart/crds/mission-control.flanksource.com_applications.yaml
+3 −0 chart/crds/mission-control.flanksource.com_permissions.yaml
+13 −16 chart/crds/mission-control.flanksource.com_playbooks.yaml
+248 −0 chart/crds/mission-control.flanksource.com_plugins.yaml
+55 −3 chart/crds/mission-control.flanksource.com_views.yaml
+3 −0 chart/templates/deployment.yaml
+3 −0 chart/templates/rbac.yaml
+7 −1 chart/values.schema.json
+6 −2 chart/values.yaml
+26 −0 crd-chart/templates/mission-control.flanksource.com_applications.yaml
+3 −0 crd-chart/templates/mission-control.flanksource.com_permissions.yaml
+13 −16 crd-chart/templates/mission-control.flanksource.com_playbooks.yaml
+248 −0 crd-chart/templates/mission-control.flanksource.com_plugins.yaml
+55 −3 crd-chart/templates/mission-control.flanksource.com_views.yaml
2 changes: 1 addition & 1 deletion modules/canary-checker
Open in desktop
Submodule canary-checker updated 19 files
+8 −0 api/v1/canary_types.go
+4 −2 api/v1/checks.go
+11 −1 api/v1/component_types.go
+8 −0 api/v1/system_types.go
+1 −1 api/v1/zz_generated.deepcopy.go
+3 −3 checks/prometheus.go
+3 −0 checks/runchecks.go
+10 −0 checks/runchecks_test.go
+1 −1 cmd/root.go
+3 −0 config/deploy/Component.yml
+3 −0 config/deploy/manifests.yaml
+4 −4 config/schemas/canary.schema.json
+8 −4 config/schemas/component.schema.json
+4 −4 config/schemas/health_prometheus.schema.json
+4 −4 config/schemas/topology.schema.json
+26 −0 fixtures/datasources/prometheus_mtls.yaml
+2 −5 go.mod
+4 −10 go.sum
+11 −15 pkg/prometheus/prometheus.go
2 changes: 1 addition & 1 deletion modules/config-db
Open in desktop
Submodule config-db updated 166 files
2 changes: 1 addition & 1 deletion modules/duty
Open in desktop
Submodule duty updated 62 files
+1 −0 .gitignore
+41 −0 Makefile
+550 −0 PROPERTIES.md
+270 −0 PROPERTIES.schema.json
+21 −0 Taskfile.yaml
+1 −26 connection/aws.go
+7 −0 connection/cnrm.go
+227 −0 connection/common.go
+6 −0 connection/eks.go
+2 −13 connection/gcs.go
+58 −11 connection/git.go
+178 −0 connection/git_logging_test.go
+8 −12 connection/gke.go
+99 −28 connection/http.go
+168 −0 connection/http_test.go
+2 −2 connection/kubernetes.go
+144 −0 connection/observability_test.go
+2 −10 connection/opensearch.go
+6 −1 connection/prometheus.go
+177 −0 context/properties.go
+20 −0 context/template.go
+1 −1 go.mod
+2 −2 go.sum
+69 −13 kubernetes/k8s.go
+17 −0 kubernetes/utils_test.go
+22 −0 models/common.go
+29 −17 models/config.go
+17 −15 models/config_access.go
+103 −0 models/config_change_dedupe.go
+42 −0 models/config_change_dedupe_test.go
+3 −0 models/permission.go
+24 −12 query/catalog_search.go
+1 −1 query/config_changes.go
+93 −3 query/config_tree.go
+155 −15 query/config_tree_test.go
+27 −7 query/resource_selector.go
+370 −0 rbac/access_review.go
+56 −7 rbac/custom_functions.go
+24 −0 rbac/custom_functions_test.go
+1 −1 rbac/model.ini
+1 −0 rbac/objects.go
+11 −0 rbac/policy/policy.go
+11 −1 schema/config.hcl
+9 −1 schema/config_access.hcl
+38 −14 start.go
+80 −0 start_test.go
+13 −0 suite_test.go
+78 −0 tests/config_access_test.go
+16 −0 tests/config_changes_test.go
+71 −1 tests/config_relationship_test.go
+3 −1 tests/e2e-blobs/containers.go
+1 −1 tests/fixtures/dummy/all.go
+26 −0 tests/generator/config_generator.go
+9 −0 tests/query_resource_selector_test.go
+8 −64 tests/setup/common.go
+5 −0 types/client_options.go
+12 −2 upstream/commands.go
+20 −17 views/006_config_views.sql
+7 −2 views/028_config_relationship_populate.sql
+43 −4 views/038_config_access.sql
+6 −6 views/045_merge_external_entities.sql
+1 −0 views/9998_rls_enable.sql
2 changes: 1 addition & 1 deletion modules/mission-control
Open in desktop
Submodule mission-control updated 334 files
2 changes: 1 addition & 1 deletion modules/mission-control-chart
Open in desktop
Submodule mission-control-chart updated 19 files
+1 −1 Makefile
+2 −2 agent-chart/Chart.yaml
+1 −1 agent-chart/values.schema.json
+1 −1 agent-chart/values.yaml
+3 −3 chart/Chart.yaml
+26 −0 chart/crds/mission-control.flanksource.com_applications.yaml
+3 −0 chart/crds/mission-control.flanksource.com_permissions.yaml
+13 −16 chart/crds/mission-control.flanksource.com_playbooks.yaml
+248 −0 chart/crds/mission-control.flanksource.com_plugins.yaml
+55 −3 chart/crds/mission-control.flanksource.com_views.yaml
+3 −0 chart/templates/deployment.yaml
+3 −0 chart/templates/rbac.yaml
+7 −1 chart/values.schema.json
+6 −2 chart/values.yaml
+26 −0 crd-chart/templates/mission-control.flanksource.com_applications.yaml
+3 −0 crd-chart/templates/mission-control.flanksource.com_permissions.yaml
+13 −16 crd-chart/templates/mission-control.flanksource.com_playbooks.yaml
+248 −0 crd-chart/templates/mission-control.flanksource.com_plugins.yaml
+55 −3 crd-chart/templates/mission-control.flanksource.com_views.yaml
2 changes: 1 addition & 1 deletion modules/mission-control-registry
Open in desktop
Submodule mission-control-registry updated 2 files
+1 −1 charts/mongo-atlas/Chart.yaml
+28 −3 charts/mongo-atlas/templates/scraper.yaml
Loading