feat: Add --web-config-file flag to the config reloader (#6011)

---------

Signed-off-by: dongjiang1989 <dongjiang1989@126.com>
Co-authored-by: Simon Pasquier <spasquie@redhat.com>

cmd/prometheus-config-reloader/main.go

@@ -35,6 +35,7 @@ import (
 	"github.com/prometheus/client_golang/prometheus/collectors"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"github.com/prometheus/common/version"
+	"github.com/prometheus/exporter-toolkit/web"
 	"github.com/thanos-io/thanos/pkg/reloader"
 
 	logging "github.com/prometheus-operator/prometheus-operator/internal/log"
@@ -76,6 +77,11 @@ func main() {
 		"address on which to expose metrics (disabled when empty)").
 		String()
 
+	webConfig := app.Flag(
+		"web-config-file",
+		"[EXPERIMENTAL] Path to configuration file that can enable TLS or authentication. See: https://prometheus.io/docs/prometheus/latest/configuration/https/",
+	).Default("").String()
+
 	logFormat := app.Flag(
 		"log-format",
 		fmt.Sprintf("log format to use. Possible values: %s", strings.Join(logging.AvailableLogFormats, ", "))).
@@ -106,6 +112,12 @@ func main() {
 		stdlog.Fatal(err)
 	}
 
+	err = web.Validate(*webConfig)
+	if err != nil {
+		level.Error(logger).Log("msg", "Unable to validate web configuration file", "err", err)
+		os.Exit(2)
+	}
+
 	if createStatefulsetOrdinalFrom != nil {
 		if err := createOrdinalEnvvar(*createStatefulsetOrdinalFrom); err != nil {
 			level.Warn(logger).Log("msg", fmt.Sprintf("Failed setting %s", statefulsetOrdinalEnvvar))
@@ -158,11 +170,14 @@ func main() {
 			w.Write([]byte(`{"status":"up"}`))
 		})
 
-		srv := http.Server{Addr: *listenAddress}
+		srv := &http.Server{}
 
 		g.Add(func() error {
 			level.Info(logger).Log("msg", "Starting web server for metrics", "listen", *listenAddress)
-			return srv.ListenAndServe()
+			return web.ListenAndServe(srv, &web.FlagConfig{
+				WebListenAddresses: &[]string{*listenAddress},
+				WebConfigFile:      webConfig,
+			}, logger)
 		}, func(error) {
 			srv.Close()
 		})

go.mod

@@ -26,6 +26,7 @@ require (
 	github.com/prometheus/alertmanager v0.26.0
 	github.com/prometheus/client_golang v1.17.0
 	github.com/prometheus/common v0.45.0
+	github.com/prometheus/exporter-toolkit v0.10.0
 	github.com/prometheus/prometheus v0.47.2
 	github.com/stretchr/testify v1.8.4
 	github.com/thanos-io/thanos v0.32.5
@@ -46,6 +47,7 @@ require (
 )
 
 require (
+	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
 	github.com/golang-jwt/jwt/v5 v5.0.0 // indirect
 	github.com/google/gnostic-models v0.6.8 // indirect

go.sum

@@ -102,6 +102,8 @@ github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDk
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/xds/go v0.0.0-20230607035331-e9ce68804cb4 h1:/inchEIKaYC1Akx+H+gqO04wryn5h75LSazbRlnya1k=
 github.com/cncf/xds/go v0.0.0-20230607035331-e9ce68804cb4/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
+github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -238,6 +240,7 @@ github.com/gobuffalo/packd v0.1.0/go.mod h1:M2Juc+hhDXf/PnmBANFCqx4DM3wRbgDvnVWe
 github.com/gobuffalo/packr/v2 v2.0.9/go.mod h1:emmyGweYTm6Kdper+iywB6YK5YzuKchGtJQZ0Odn4pQ=
 github.com/gobuffalo/packr/v2 v2.2.0/go.mod h1:CaAwI0GPIAv+5wKLtv8Afwl+Cm78K/I/VCm/3ptBN+0=
 github.com/gobuffalo/syncx v0.0.0-20190224160051-33c29581e754/go.mod h1:HhnNqWY95UYwwW3uSASeV7vtgYkT2t16hJgV3AEPUpw=
+github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
@@ -502,6 +505,8 @@ github.com/prometheus/common v0.45.0 h1:2BGz0eBc2hdMDLnO/8n0jeB3oPrt2D08CekT0lne
 github.com/prometheus/common v0.45.0/go.mod h1:YJmSTw9BoKxJplESWWxlbyttQR4uaEcGyv9MZjVOJsY=
 github.com/prometheus/common/sigv4 v0.1.0 h1:qoVebwtwwEhS85Czm2dSROY5fTo2PAPEVdDeppTwGX4=
 github.com/prometheus/common/sigv4 v0.1.0/go.mod h1:2Jkxxk9yYvCkE5G1sQT7GuEXm57JrvHu9k5YwTjsNtI=
+github.com/prometheus/exporter-toolkit v0.10.0 h1:yOAzZTi4M22ZzVxD+fhy1URTuNRj/36uQJJ5S8IPza8=
+github.com/prometheus/exporter-toolkit v0.10.0/go.mod h1:+sVFzuvV5JDyw+Ih6p3zFxZNVnKQa3x5qPmDSiPu4ZY=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+GxbHq6oeK9A=

pkg/operator/config_reloader.go

@@ -41,6 +41,7 @@ const (
 type ConfigReloader struct {
 	name               string
 	config             ContainerConfig
+	webConfigFile      string
 	configFile         string
 	configEnvsubstFile string
 	imagePullPolicy    v1.PullPolicy
@@ -71,6 +72,13 @@ func WatchedDirectories(watchedDirectories []string) ReloaderOption {
 	}
 }
 
+// WebConfigFile sets the webConfigFile option for the config-reloader container
+func WebConfigFile(config string) ReloaderOption {
+	return func(c *ConfigReloader) {
+		c.webConfigFile = config
+	}
+}
+
 // ConfigFile sets the configFile option for the config-reloader container
 func ConfigFile(configFile string) ReloaderOption {
 	return func(c *ConfigReloader) {
@@ -120,7 +128,7 @@ func LogFormat(logFormat string) ReloaderOption {
 	}
 }
 
-// LogLevel sets the logLevel option for the config-reloader container\
+// LogLevel sets the logLevel option for the config-reloader container
 func LogLevel(logLevel string) ReloaderOption {
 	return func(c *ConfigReloader) {
 		c.logLevel = logLevel
@@ -188,6 +196,10 @@ func CreateConfigReloader(name string, options ...ReloaderOption) v1.Container {
 		)
 	}
 
+	if len(configReloader.webConfigFile) > 0 {
+		args = append(args, fmt.Sprintf("--web-config-file=%s", configReloader.webConfigFile))
+	}
+
 	if len(configReloader.reloadURL.String()) > 0 {
 		args = append(args, fmt.Sprintf("--reload-url=%s", configReloader.reloadURL.String()))
 	}

pkg/operator/config_reloader_test.go

@@ -122,6 +122,7 @@ func TestCreateConfigReloader(t *testing.T) {
 	logFormat := "logFormat"
 	logLevel := "logLevel"
 	configFile := "configFile"
+	webConfigFile := "webConfigFile"
 	configEnvsubstFile := "configEnvsubstFile"
 	watchedDirectories := []string{"directory1", "directory2"}
 	shard := int32(1)
@@ -141,6 +142,7 @@ func TestCreateConfigReloader(t *testing.T) {
 		ConfigFile(configFile),
 		ConfigEnvsubstFile(configEnvsubstFile),
 		WatchedDirectories(watchedDirectories),
+		WebConfigFile(webConfigFile),
 		Shard(shard),
 		ImagePullPolicy(expectedImagePullPolicy),
 	)
@@ -165,6 +167,9 @@ func TestCreateConfigReloader(t *testing.T) {
 	if !contains(container.Args, "--config-envsubst-file=configEnvsubstFile") {
 		t.Errorf("Expected '--config-envsubst-file=%s' not found in %s", configEnvsubstFile, container.Args)
 	}
+	if !contains(container.Args, "--web-config-file=webConfigFile") {
+		t.Errorf("Expected '--web-config-file=%s' not found in %s", webConfigFile, container.Args)
+	}
 	for _, dir := range watchedDirectories {
 		if !contains(container.Args, fmt.Sprintf("--watched-dir=%s", dir)) {
 			t.Errorf("Expected '--watched-dir=%s' not found in %s", dir, container.Args)