3 ms·
How do you deal with security? Are all nodes accepting connections from the monitoring node? With push, the monitoring node is exposed, but it is a less valuabl
by bornfreddy 4y ago
How do you deal with security? Are all nodes accepting connections from the monitoring node? With push, the monitoring node is exposed, but it is a less valuable target than every node in the network.
This is my main gripe with Prometheus (didn't use it yet).
- whateveracct 4y agoFeels like some combination of VPCs and bastion edges would work
- luismedel 4y agoExactly. I feel that monitoring solutions have to be the opposite of backup ones. For backups, you ideally want the backup server to do a pull from the backed-up servers, to avoid that a security incident in one of them could damage your backups. But for monitoring, I feel that push is the way to go. I want only the minimal, indispensable connections into my production servers.
- noja 4y agoFor backups you can push with no security problems (unless you are doing a straight copy). If your backup client has rights to overwrite previous backups, that's a design problem.