f10a723513
Closes #1372. Part of #1371. Adds CLI flags for the parts of the Postgres connection config that aren't secrets: --datasource.uri (replaces DATA_SOURCE_URI), plus --datasource.uri-file, --datasource.user-file and --datasource.pass-file (replacing the *_FILE env vars) for values sourced from mounted files. The user and password values themselves stay env-var only (DATA_SOURCE_USER / DATA_SOURCE_PASS), since CLI flags are readable via /proc and the Kubernetes API and would leak the secret itself. The *-file flags carry only a path, the same pattern Prometheus uses for password_file, so no secret ever reaches the command line. Flag and env var reading now lives in cmd/postgres_exporter rather than the exporter package, which we're trying to shrink. exporter.GetDataSources stays for embedders, marked deprecated with a migration note, and will be removed in v0.22.0. The four env vars that gained a flag are deprecated: the exporter warns at startup when one is set, the CHANGELOG maps each to its replacement, and the docs now configure the exporter by flag. Each flag falls back to its env var when unset, so behavior is unchanged when only env vars are set. Precedence is unchanged: DATA_SOURCE_NAME wins over everything, *_FILE wins over the plain value. Signed-off-by: Nicolas Takashi <nicolas.takashi@dash0.com> Co-authored-by: Arthur Silva Sens <arthursens2005@gmail.com>
2.9 KiB
title, nav_title, sort_rank
| title | nav_title | sort_rank |
|---|---|---|
| Docker Images | Docker | 7 |
Docker Images
Official images are published to three registries, kept in sync on every release:
- Docker Hub:
prometheuscommunity/postgres-exporter - Quay.io:
quay.io/prometheuscommunity/postgres-exporter - GHCR:
ghcr.io/prometheus-community/postgres-exporter
All three are the same image; there's no functional difference between them — use whichever registry your infrastructure prefers. Note that the GHCR organization is prometheus-community (hyphenated, matching the GitHub org), while Docker Hub and Quay use prometheuscommunity.
Tags
latest— the most recent release.vX.Y.Z— a specific release, e.g.v0.20.1. Pin to a specific tag for production deployments so upgrades are intentional.master— the latest build from themasterbranch, which may be unstable. Use this only for testing or development.
Available tags are listed on the Docker Hub tags page.
Image details
- Based on a minimal
busyboximage. - The exporter binary is at
/bin/postgres_exporterand is also the containerENTRYPOINT, so flags can be passed directly as container arguments. - Exposes port
9187. - The process runs as the
nobodyuser, uid/gid65534. If you mount config or secret files into the container (e.g. for--datasource.pass-fileor--config.file), make sure they're readable by that uid/gid.
Running
Getting Started covers the basic invocation. A couple of things that are specific to running in a container:
Because the binary is the ENTRYPOINT, flags go straight on the end of the docker run line:
docker run \
-p 9187:9187 \
-e DATA_SOURCE_USER=postgres \
-e DATA_SOURCE_PASS=password \
quay.io/prometheuscommunity/postgres-exporter \
--datasource.uri="my-postgres-host:5432/postgres?sslmode=disable" \
--no-collector.stat_bgwriter --log.level=debug
To mount a secrets file instead of passing a password in an environment variable:
docker run \
-p 9187:9187 \
-e DATA_SOURCE_USER=postgres \
-v /path/to/pg_password:/run/secrets/pg_password:ro \
quay.io/prometheuscommunity/postgres-exporter \
--datasource.uri="my-postgres-host:5432/postgres?sslmode=disable" \
--datasource.pass-file=/run/secrets/pg_password
See Secrets for all the supported ways to supply credentials.
Building the image yourself
make promu
promu crossbuild -p linux/amd64 -p linux/armv7 -p linux/arm64 -p linux/ppc64le
make docker
This produces a local image tagged prometheuscommunity/postgres-exporter-linux-<arch>:${branch}.