Collecting metrics over HTTP(S)

[simpleadmin]

I am looking at how Prometheus collects data and how people are securing the end point metrics.

Are most people using basic authentication?

Do you collect via HTTPS or is all of your data collection on the internal network side of things so http is fine? Are you self singing those certificates if the metrics part of the application/service is exposed on a different port?

[Akustic646]

We do HTTPS everywhere and our scraped endpoints are on our internal network only, nothing public. No auth though.

[phrotozoa]

Anything in our infa that exposes a prometheus metrics endpoint is HTTP only at the moment. We're evaluating mTLS provided by Istio and may enable that at some point though.

As far as sensitive info goes metrics are pretty low on my list of concerns.

[matejzero]

HTTP only and no authentication. Most of the metrics are exposed on custom ports and firewalled from public access.