IBM Cloud Private: Credentials needed to access prometheus port 9090

Question

I used kubectl proxy to access the ICP prometheus service. Eg http://localhost:8001/api/v1/proxy/namespaces/kube-system/services/monitoring-prometheus:9090/ However this returns a 401 unauthorized.

What authorization header/certs is needed to allow one to access prometheus in ICP?

My goal is to use Prometheus UI/api directly (to try some queries). I see that in the ICP monitoring for Grafana, the Prometheus datasource has TLS and ca cert configured so I would like to know how to acquire those details.

Answer 1

I use a curl command like this, which you should be able to convert to whatever you use to make the request and interpret the response:

curl -ks -H "Authorization:Bearer $ACCESS_TOKEN" https://$MASTER_IP:8443/prometheus/api/v1/query?query=$QUERY

ACCESS_TOKEN is the Access token returned by cloudctl tokens after logging in with cloudctl login. MASTER_IP and QUERY should be obvious, but you will need to escape special characters in your QUERY so that it can be interpreted by Prometheus correctly.

You can find more details on this at these links (some of the details aren't quite accurate right now, but they will be updated soon):

• https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.2/apis/access_api.html
• https://www.ibm.com/support/knowledgecenter/SSBS6K_3.1.2/apis/prometheus.html