f10a723513
Closes #1372. Part of #1371. Adds CLI flags for the parts of the Postgres connection config that aren't secrets: --datasource.uri (replaces DATA_SOURCE_URI), plus --datasource.uri-file, --datasource.user-file and --datasource.pass-file (replacing the *_FILE env vars) for values sourced from mounted files. The user and password values themselves stay env-var only (DATA_SOURCE_USER / DATA_SOURCE_PASS), since CLI flags are readable via /proc and the Kubernetes API and would leak the secret itself. The *-file flags carry only a path, the same pattern Prometheus uses for password_file, so no secret ever reaches the command line. Flag and env var reading now lives in cmd/postgres_exporter rather than the exporter package, which we're trying to shrink. exporter.GetDataSources stays for embedders, marked deprecated with a migration note, and will be removed in v0.22.0. The four env vars that gained a flag are deprecated: the exporter warns at startup when one is set, the CHANGELOG maps each to its replacement, and the docs now configure the exporter by flag. Each flag falls back to its env var when unset, so behavior is unchanged when only env vars are set. Precedence is unchanged: DATA_SOURCE_NAME wins over everything, *_FILE wins over the plain value. Signed-off-by: Nicolas Takashi <nicolas.takashi@dash0.com> Co-authored-by: Arthur Silva Sens <arthursens2005@gmail.com>
2.9 KiB
title, sort_rank
| title | sort_rank |
|---|---|
| Connecting to PostgreSQL | 3 |
Connecting to PostgreSQL
How the exporter connects
The exporter connects using a standard PostgreSQL connection string / DSN, e.g. postgresql://user:pass@host:5432/dbname?sslmode=disable. Any parameter supported by github.com/lib/pq can be included in the DSN's query string (sslmode, connect_timeout, application_name, etc.).
Each scrape opens a connection using that DSN, runs the enabled collectors' queries, and closes it — the exporter keeps at most one open connection per configured target at a time. On each successful connection to a target, the exporter also detects the PostgreSQL server version, which determines which version-specific queries collectors use.
Single-target mode (the default)
In single-target mode, the exporter scrapes one DSN configured at startup (via the --datasource.* flags or DATA_SOURCE_NAME — see Secrets) and always serves their metrics at /metrics. This is the typical deployment: one exporter process per database instance, usually as a sidecar.
Multi-target mode (/probe)
For cases where running a sidecar isn't possible (for example, a SaaS-managed PostgreSQL instance) or not preferred, the exporter supports the multi-target pattern: a single exporter process can scrape many different servers, chosen per-request.
Send the target as a query parameter:
http://exporter:9187/probe?target=my-db-host:5432
Prometheus is typically configured to do this via relabeling so the target list can come from service discovery:
scrape_configs:
- job_name: 'postgres'
static_configs:
- targets:
- server1:5432
- server2:5432
metrics_path: /probe
params:
auth_module: [foo]
relabel_configs:
- source_labels: [__address__]
target_label: __param_target
- source_labels: [__param_target]
target_label: instance
- target_label: __address__
replacement: 127.0.0.1:9187 # the exporter's real host:port
Credentials for /probe targets come from an auth_module defined in the config file, referenced via the auth_module query/HTTP parameter — this avoids putting usernames and passwords in the target URL.
Connection timeout
PG_EXPORTER_COLLECTION_TIMEOUT (default 1m) bounds how long a scrape is allowed to take before the exporter drops the connection. This protects against connections piling up if the database is slow to respond (e.g. during a large DDL operation holding locks). Values less than 1ms are invalid.
Running against non-superusers or unusual variants
- Non-superuser connections need specific grants — see Database Permissions.