Add a prometheus user to all postgres clusters

diff --git a/cookbooks/postgresql/recipes/default.rb b/cookbooks/postgresql/recipes/default.rb
index 9f713b60e9834f28300df03169dd31a7d323fe92..ed58edb717a89dc96c8ae3500434a10ab1d49a50 100644 (file)
--- a/cookbooks/postgresql/recipes/default.rb
+++ b/cookbooks/postgresql/recipes/default.rb
@@ -116,11 +116,19 @@ package "pgtop"
 package "libdbd-pg-perl"
 
 clusters = node[:postgresql][:clusters] || []
 package "libdbd-pg-perl"
 
 clusters = node[:postgresql][:clusters] || []

+passwords = data_bag_item("postgresql", "passwords")

 
 clusters.each do |name, details|
   prometheus_suffix = name.tr("/", "-")
   prometheus_database = node[:postgresql][:monitor_database]
 
 
 clusters.each do |name, details|
   prometheus_suffix = name.tr("/", "-")
   prometheus_database = node[:postgresql][:monitor_database]
 

+  postgresql_user "prometheus" do
+    cluster name
+    password passwords["prometheus"]
+    roles "pg_monitor"
+    not_if { ::File.exist?("/var/lib/postgresql/#{name}/standby.signal") }
+  end
+

   prometheus_exporter "postgres" do
     port 10000 + details[:port].to_i
     service "postgres-#{prometheus_suffix}"
   prometheus_exporter "postgres" do
     port 10000 + details[:port].to_i
     service "postgres-#{prometheus_suffix}"

diff --git a/cookbooks/postgresql/templates/default/pg_hba.conf.erb b/cookbooks/postgresql/templates/default/pg_hba.conf.erb
index 18b490c03c1de3b02ceb672087099483e7dd6f32..cb561691f9061f3f5f6be0bc638f6ba7535caf30 100644 (file)
--- a/cookbooks/postgresql/templates/default/pg_hba.conf.erb
+++ b/cookbooks/postgresql/templates/default/pg_hba.conf.erb
@@ -4,6 +4,7 @@
 <% @early_rules.each do |rule| -%>
 <%= rule[:type] || "host" %>   <%= rule[:database] || "all" %>         <%= rule[:user] || "all" %>             <%= rule[:address] %>           <%= rule[:method] || "md5" %> <%= (rule[:options] || {}).collect { |k,v| "#{k}=#{v}" }.join(" ") %>
 <% end -%>
 <% @early_rules.each do |rule| -%>
 <%= rule[:type] || "host" %>   <%= rule[:database] || "all" %>         <%= rule[:user] || "all" %>             <%= rule[:address] %>           <%= rule[:method] || "md5" %> <%= (rule[:options] || {}).collect { |k,v| "#{k}=#{v}" }.join(" ") %>
 <% end -%>

+local  all             prometheus                              md5

 local  all             all                                     peer
 host   all             all             127.0.0.1/32            md5
 host   all             all             ::1/128                 md5
 local  all             all                                     peer
 host   all             all             127.0.0.1/32            md5
 host   all             all             ::1/128                 md5

diff --git a/test/data_bags/postgresql/passwords.json b/test/data_bags/postgresql/passwords.json
new file mode 100644 (file)
index 0000000..120914c
--- /dev/null
+++ b/test/data_bags/postgresql/passwords.json
@@ -0,0 +1,4 @@
+{
+  "id": "passwords",
+  "prometheus": "prometheus-password"
+}