How to configure Prometheus consul_sd_configs to use https for service

First, consul_sd_configs is a configuration in Prometheus used for discovering services registered in Consul. To establish HTTPS connections to Consul services, several key configurations are required.

Step 1: Ensure Consul is Configured for HTTPS

First, ensure that your Consul server is configured to support HTTPS. This typically involves setting the verify_incoming, verify_outgoing, ca_file, cert_file, and key_file options in the Consul configuration file. For example:

json
{
  "verify_incoming": true,
  "verify_outgoing": true,
  "ca_file": "/etc/consul.d/ssl/ca.pem",
  "cert_file": "/etc/consul.d/ssl/consul.pem",
  "key_file": "/etc/consul.d/ssl/consul-key.pem"
}

Step 2: Configure Prometheus

In the Prometheus configuration file, add or modify the consul_sd_configs section to specify the Consul HTTPS endpoint and necessary TLS configurations.

yaml
scrape_configs:
  - job_name: 'consul-services'
    consul_sd_configs:
      - server: 'https://consul-server:8501'  # Using HTTPS port
        tls_config:
          ca_file: '/path/to/ca.pem'  # CA certificate path
          cert_file: '/path/to/client.pem'  # Client certificate path
          key_file: '/path/to/client-key.pem'  # Client key path
          insecure_skip_verify: false  # Not recommended to skip verification

Key Points

• server: Must point to the Consul server and use the correct HTTPS port (default is 8501; use the appropriate port if modified).
• tls_config: This section is critical as it instructs Prometheus on how to connect to Consul via TLS.
  • ca_file: Points to the trusted CA certificate used to verify the Consul server's certificate.
  • cert_file: Client certificate used by Prometheus for authentication.
  • key_file: The private key corresponding to the client certificate.
  • insecure_skip_verify: Set to false to ensure secure TLS connections.

Example

Assume a service is registered in Consul with HTTPS enabled. With the above Prometheus configuration, Prometheus will discover and scrape metrics from these services securely over HTTPS.