TLS, authentication, authorization, audit logging, security alerting
«Защитите мониторинг, иначе он станет уязвимостью»
Prometheus не имеет встроенного TLS. Используйте nginx:
server {
listen 443 ssl;
ssl_certificate /etc/ssl/certs/prometheus.crt;
ssl_certificate_key /etc/ssl/private/prometheus.key;
location / {
proxy_pass http://localhost:9090;
}
}oauth2-proxy \
--provider=github \
--email-domain=example.com \
--upstream=http://localhost:9090Kubernetes ServiceAccount с минимальными разрешениями:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: prometheus
rules:
- apiGroups: [""]
resources: ["pods", "services", "endpoints"]
verbs: ["get", "list", "watch"]# grafana.ini
[audit]
enabled = true- alert: FailedLoginSpike
expr: rate(grafana_login_failed_total[5m]) > 10
severity: warning
- alert: ConfigChanged
expr: changes(grafana_dashboards_total[1h]) > 0
severity: infoДалее: Compliance monitoring: SOC2, GDPR, HIPAA