Prometheus: Set a Target API Key with http_headers and proxy_url

Combine scrape http_headers with proxy_url and keep source-server API headers separate from CONNECT headers sent to the intermediary.

When an HTTPS metrics endpoint requires an API key and Prometheus must use a forward proxy, configure the header on the scrape request itself. For a Prometheus version supporting http_headers:

scrape_configs:
  - job_name: secured_metrics
    scheme: https
    metrics_path: /metrics
    proxy_url: http://proxy.example:8080
    http_headers:
      X-API-Key:
        files:
          - /etc/prometheus/secrets/metrics-api-key
    static_configs:
      - targets: ['metrics.example:443']

The file contains the intended target API key and must be readable in the Prometheus execution environment. In a container, provision it at that container-side path.

http_headers places X-API-Key on the request for metrics.example. Through a normal HTTPS CONNECT tunnel, that header travels inside destination TLS. The intermediary supplies connectivity and must allow the tunnel. For a publicly reachable metrics endpoint where public intermediaries are permitted, the HTTP proxy list provides candidates for the no-account proxy_url; keep the API key on the destination request.

proxy_connect_header has another destination: the intermediary receives those headers on CONNECT. Putting a target API key there does not deliver it as an HTTPS request header to the metrics server.

Keep the actual metrics hostname and path in the scrape configuration. Prometheus also protects headers it sets itself from arbitrary overrides, so use the supported custom-header fields for this API key.

Winndannde jowitiiɗe heen