Add basic auth for Prometheus client

cmd/icinga-kubernetes/main.go

@@ -27,6 +27,7 @@ import (
 	"k8s.io/client-go/kubernetes"
 	kclientcmd "k8s.io/client-go/tools/clientcmd"
 	"k8s.io/klog/v2"
+	"net/http"
 	"os"
 	"strings"
 	"time"
@@ -128,9 +129,21 @@ func main() {
 	}
 
 	if cfg.Prometheus.Url != "" {
-		promClient, err := promapi.NewClient(promapi.Config{Address: cfg.Prometheus.Url})
+		var basicAuthTransport http.RoundTripper
+
+		if cfg.Prometheus.Username != "" && cfg.Prometheus.Password != "" {
+			basicAuthTransport = &internal.BasicAuthTransport{
+				Username: cfg.Prometheus.Username,
+				Password: cfg.Prometheus.Password,
+			}
+		}
+
+		promClient, err := promapi.NewClient(promapi.Config{
+			Address:      cfg.Prometheus.Url,
+			RoundTripper: basicAuthTransport,
+		})
 		if err != nil {
-			klog.Fatal(errors.Wrap(err, "error creating promClient"))
+			klog.Fatal(errors.Wrap(err, "error creating Prometheus client"))
 		}
 
 		promApiClient := promv1.NewAPI(promClient)

internal/basic_auth.go

@@ -0,0 +1,20 @@
+package internal
+
+import (
+	"encoding/base64"
+	"net/http"
+)
+
+// BasicAuthTransport is a http.RoundTripper that authenticates all requests using HTTP Basic Authentication
+type BasicAuthTransport struct {
+	Username string
+	Password string
+}
+
+// RoundTrip executes a single HTTP transaction with the basic auth credentials
+func (rt *BasicAuthTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	basicAuth := "Basic " + base64.StdEncoding.EncodeToString([]byte(rt.Username+":"+rt.Password))
+	req.Header.Set("Authorization", basicAuth)
+
+	return http.DefaultTransport.RoundTrip(req)
+}

pkg/metrics/config.go

@@ -9,7 +9,9 @@ import (
 
 // PrometheusConfig defines Prometheus configuration.
 type PrometheusConfig struct {
-	Url string `yaml:"url"`
+	Url      string `yaml:"url"`
+	Username string `yaml:"username"`
+	Password string `yaml:"password"`
 }
 
 // Validate checks constraints in the supplied Prometheus configuration and returns an error if they are violated.