Merge pull request #3271 from weaveworks/metrics-addr

Only expose metrics by default in weave-kube

prog/weave-kube/launch.sh

@@ -27,7 +27,7 @@ xt_set_exists() {
 # Default if not supplied - same as weave net default
 IPALLOC_RANGE=${IPALLOC_RANGE:-10.32.0.0/12}
 HTTP_ADDR=${WEAVE_HTTP_ADDR:-127.0.0.1:6784}
-STATUS_ADDR=${WEAVE_STATUS_ADDR:-0.0.0.0:6782}
+METRICS_ADDR=${WEAVE_METRICS_ADDR:-0.0.0.0:6782}
 HOST_ROOT=${HOST_ROOT:-/host}
 CONN_LIMIT=${CONN_LIMIT:-100}
 DB_PREFIX=${DB_PREFIX:-/weavedb/weave-net}
@@ -54,6 +54,12 @@ else
     fi
 fi
 
+STATUS_OPTS="--metrics-addr=$METRICS_ADDR"
+# --status-addr exposes internal information, so only turn it on if asked to.
+if [ -n "${WEAVE_STATUS_ADDR}" ]; then
+    STATUS_OPTS="$STATUS_OPTS --status-addr=$WEAVE_STATUS_ADDR"
+fi
+
 # Default is that npc will be running; allow caller to override
 WEAVE_NPC_OPTS="--expect-npc"
 if [ "${EXPECT_NPC}" = "0" ]; then
@@ -144,7 +150,7 @@ post_start_actions &
 /home/weave/weaver $EXTRA_ARGS --port=6783 $(router_bridge_opts) \
      --name="$PEERNAME" \
      --host-root=$HOST_ROOT \
-     --http-addr=$HTTP_ADDR --status-addr=$STATUS_ADDR --docker-api='' --no-dns \
+     --http-addr=$HTTP_ADDR $STATUS_OPTS --docker-api='' --no-dns \
      --db-prefix="$DB_PREFIX" \
      --ipalloc-range=$IPALLOC_RANGE $NICKNAME_ARG \
      --ipalloc-init $IPALLOC_INIT \

prog/weaver/main.go

@@ -155,6 +155,7 @@ func main() {
 		noDiscovery        bool
 		httpAddr           string
 		statusAddr         string
+		metricsAddr        string
 		ipamConfig         ipamConfig
 		dockerAPI          string
 		peers              []string
@@ -192,6 +193,7 @@ func main() {
 	mflag.IntVar(&bridgeConfig.MTU, []string{"-mtu"}, 0, "MTU size")
 	mflag.StringVar(&httpAddr, []string{"-http-addr"}, "", "address to bind HTTP interface to (disabled if blank, absolute path indicates unix domain socket)")
 	mflag.StringVar(&statusAddr, []string{"-status-addr"}, "", "address to bind status+metrics interface to (disabled if blank, absolute path indicates unix domain socket)")
+	mflag.StringVar(&metricsAddr, []string{"-metrics-addr"}, "", "address to bind metrics interface to (disabled if blank, absolute path indicates unix domain socket)")
 	mflag.StringVar(&ipamConfig.Mode, []string{"-ipalloc-init"}, "", "allocator initialisation strategy (consensus, seed or observer)")
 	mflag.StringVar(&ipamConfig.IPRangeCIDR, []string{"-ipalloc-range"}, "", "IP address range reserved for automatic allocation, in CIDR notation")
 	mflag.StringVar(&ipamConfig.IPSubnetCIDR, []string{"-ipalloc-default-subnet"}, "", "subnet to allocate within by default, in CIDR notation")
@@ -474,10 +476,17 @@ func main() {
 		muxRouter.Methods("GET").Path("/metrics").Handler(metricsHandler(router, allocator, ns, dnsserver))
 		statusMux := http.NewServeMux()
 		statusMux.Handle("/", muxRouter)
-		Log.Println("Listening for metrics requests on", statusAddr)
+		Log.Println("Listening for status+metrics requests on", statusAddr)
 		go listenAndServeHTTP(statusAddr, statusMux)
 	}
 
+	if metricsAddr != "" {
+		metricsMux := http.NewServeMux()
+		metricsMux.Handle("/metrics", metricsHandler(router, allocator, ns, dnsserver))
+		Log.Println("Listening for metrics requests on", metricsAddr)
+		go listenAndServeHTTP(metricsAddr, metricsMux)
+	}
+
 	if plugin != nil {
 		go plugin.Start(httpAddr, dockerCli, waitReady.Add())
 	}

site/kubernetes/kube-addon.md

@@ -346,6 +346,10 @@ The list of variables you can set is:
 * `WEAVE_EXPOSE_IP` - set the IP address used as a gateway from the
   Weave network to the host network - this is useful if you are
   configuring the addon as a static pod.
+* `WEAVE_METRICS_ADDR` - address and port that the Weave Net
+  daemon will serve Prometheus-style metrics on (defaults to 0.0.0.0:6782)
+* `WEAVE_STATUS_ADDR` - address and port that the Weave Net
+  daemon will serve status requests on (defaults to disabled)
 * `WEAVE_MTU` - Weave Net defaults to 1376 bytes, but you can set a
   smaller size if your underlying network has a tighter limit, or set
   a larger size for better performance if your network supports jumbo

site/tasks/manage/metrics.md

@@ -10,9 +10,6 @@ controller](/site/kubernetes/kube-addon.md#npc).
 
 ### Router Metrics
 
-The endpoint address is `localhost:6782`; the following metrics are
-exposed:
-
 * `weave_connections` - Number of peer-to-peer connections.
 * `weave_connection_terminations_total` - Number of peer-to-peer
   connections terminated.
@@ -25,27 +22,35 @@ exposed:
 * `weave_ipam_pending_allocates` - Number of pending allocates.
 * `weave_ipam_pending_claims` - Number of pending claims.
 
-#### Publish Router Metrics Endpoint
-
-By default, when started via `weave launch`, weave listens on its local
-interface to serve metrics. To publish your metrics throughout your cluster,
-e.g. if your prometheus server is installed on a different host machine,
-you need to set `WEAVE_STATUS_ADDR` to your corresponding IP and port.
-Default port is 6782.
-
-`WEAVE_STATUS_ADDR=X.X.X.X:PORT`
-
-You can set `WEAVE_STATUS_ADDR=0.0.0.0:6782` to listen on all interfaces,
-but be aware, this may expose your metrics to the public internet.
-
 ### Kubernetes Network Policy Controller Metrics
 
-The endpoint address is `localhost:6781`; the following metric is
+The following metric is
 exposed:
 
 * `weavenpc_blocked_connections_total` - Connection attempts blocked
   by policy controller.
 
+### Metrics Endpoint Addresses
+
+When installed as a Kubernetes Addon, the router listens for metrics
+requests on 0.0.0.0:6782 and the Network Policy Controller listens on
+0.0.0.0:6781. No other requests are served on these endpoints.
+
+>Note: If your Kubernetes hosts are exposed to the public internet
+then these metrics endpoints will also be exposed.
+
+When started via `weave launch`, by default weave listens on its local
+interface to serve metrics and other read-only status requests. To
+publish your metrics throughout your cluster, you can set
+`WEAVE_STATUS_ADDR`:
+
+`WEAVE_STATUS_ADDR=X.X.X.X:PORT`
+
+Set it to an empty string to disable.
+
+You can also pass the parameter `--metrics-addr=X.X.X.X:PORT` to
+`weave launch` to specify an address to listen for metrics only.
+
 # Static Configuration for Weave Net
 
 The following YAML fragment can be used in your Prometheus configuration to