PMM-12422 restrict agent interface

admin/commands/management/add.go

@@ -30,11 +30,21 @@ type AddCommand struct {
 	ProxySQL           AddProxySQLCommand           `cmd:"" name:"proxysql" help:"Add ProxySQL to monitoring"`
 }
 
+// globalAddServiceParams holds common parameters that are passed as flags to the `add` command.
+type globalAddServiceParams struct {
+	serviceName           string
+	socket                string
+	host                  string
+	port                  uint16
+	exposeExporterAddress bool
+}
+
 // AddCommonFlags is used by Kong for CLI flags and commands.
 type AddCommonFlags struct {
-	AddServiceNameFlag string `name:"service-name" placeholder:"NAME" help:"Service name (overrides positional argument)"`
-	AddHostFlag        string `name:"host" placeholder:"HOST" help:"Service hostname or IP address (overrides positional argument)"`
-	AddPortFlag        uint16 `name:"port" placeholder:"PORT" help:"Service port number (overrides positional argument)"`
+	AddServiceNameFlag           string `name:"service-name" placeholder:"NAME" help:"Service name (overrides positional argument)"`
+	AddHostFlag                  string `name:"host" placeholder:"HOST" help:"Service hostname or IP address (overrides positional argument)"`
+	AddPortFlag                  uint16 `name:"port" placeholder:"PORT" help:"Service port number (overrides positional argument)"`
+	AddExposeExporterAddressFlag bool   `name:"expose-exporter-address" placeholder:"EXPOSE-EXPORTER" help:"Expose the address of the exporter publicly on 0.0.0.0"`
 }
 
 // AddLogLevelFatalFlags contains log level flag with "fatal" option.
@@ -60,7 +70,7 @@ type connectionGetter interface {
 // - addPostgreSQLCommand
 // - addMongoDBCommand
 // Returns service name, socket, host, port, error.
-func processGlobalAddFlagsWithSocket(cmd connectionGetter, opts AddCommonFlags) (string, string, string, uint16, error) {
+func processGlobalAddFlagsWithSocket(cmd connectionGetter, opts AddCommonFlags) (globalAddServiceParams, error) {
 	serviceName := cmd.GetServiceName()
 	if opts.AddServiceNameFlag != "" {
 		serviceName = opts.AddServiceNameFlag
@@ -74,18 +84,19 @@ func processGlobalAddFlagsWithSocket(cmd connectionGetter, opts AddCommonFlags)
 
 	var portI int
 	var host string
+	var exposeExporterAddress bool
 	var err error
 
 	if address != "" {
 		var portS string
 		host, portS, err = net.SplitHostPort(address)
 		if err != nil {
-			return "", "", "", 0, err
+			return globalAddServiceParams{}, err
 		}
 
 		portI, err = strconv.Atoi(portS)
 		if err != nil {
-			return "", "", "", 0, err
+			return globalAddServiceParams{}, err
 		}
 	}
 
@@ -97,5 +108,14 @@ func processGlobalAddFlagsWithSocket(cmd connectionGetter, opts AddCommonFlags)
 		portI = int(opts.AddPortFlag)
 	}
 
-	return serviceName, socket, host, uint16(portI), nil
+	if opts.AddExposeExporterAddressFlag {
+		exposeExporterAddress = opts.AddExposeExporterAddressFlag
+	}
+	return globalAddServiceParams{
+		serviceName:           serviceName,
+		socket:                socket,
+		host:                  host,
+		port:                  uint16(portI),
+		exposeExporterAddress: exposeExporterAddress,
+	}, nil
 }

admin/commands/management/add_mongodb.go

@@ -141,7 +141,7 @@ func (cmd *AddMongoDBCommand) RunCmd() (commands.Result, error) {
 		}
 	}
 
-	serviceName, socket, host, port, err := processGlobalAddFlagsWithSocket(cmd, cmd.AddCommonFlags)
+	globalFlags, err := processGlobalAddFlagsWithSocket(cmd, cmd.AddCommonFlags)
 	if err != nil {
 		return nil, err
 	}
@@ -154,18 +154,19 @@ func (cmd *AddMongoDBCommand) RunCmd() (commands.Result, error) {
 
 	params := &mongodb.AddMongoDBParams{
 		Body: mongodb.AddMongoDBBody{
-			NodeID:         cmd.NodeID,
-			ServiceName:    serviceName,
-			Address:        host,
-			Port:           int64(port),
-			Socket:         socket,
-			PMMAgentID:     cmd.PMMAgentID,
-			Environment:    cmd.Environment,
-			Cluster:        cmd.Cluster,
-			ReplicationSet: cmd.ReplicationSet,
-			Username:       cmd.Username,
-			Password:       cmd.Password,
-			AgentPassword:  cmd.AgentPassword,
+			NodeID:                cmd.NodeID,
+			ServiceName:           globalFlags.serviceName,
+			Address:               globalFlags.host,
+			Port:                  int64(globalFlags.port),
+			Socket:                globalFlags.socket,
+			ExposeExporterAddress: globalFlags.exposeExporterAddress,
+			PMMAgentID:            cmd.PMMAgentID,
+			Environment:           cmd.Environment,
+			Cluster:               cmd.Cluster,
+			ReplicationSet:        cmd.ReplicationSet,
+			Username:              cmd.Username,
+			Password:              cmd.Password,
+			AgentPassword:         cmd.AgentPassword,
 
 			QANMongodbProfiler: cmd.QuerySource == MongodbQuerySourceProfiler,
 

admin/commands/management/add_mysql.go

@@ -188,7 +188,7 @@ func (cmd *AddMySQLCommand) RunCmd() (commands.Result, error) {
 		}
 	}
 
-	serviceName, socket, host, port, err := processGlobalAddFlagsWithSocket(cmd, cmd.AddCommonFlags)
+	globalFlags, err := processGlobalAddFlagsWithSocket(cmd, cmd.AddCommonFlags)
 	if err != nil {
 		return nil, err
 	}
@@ -204,19 +204,20 @@ func (cmd *AddMySQLCommand) RunCmd() (commands.Result, error) {
 
 	params := &mysql.AddMySQLParams{
 		Body: mysql.AddMySQLBody{
-			NodeID:         cmd.NodeID,
-			ServiceName:    serviceName,
-			Address:        host,
-			Socket:         socket,
-			Port:           int64(port),
-			PMMAgentID:     cmd.PMMAgentID,
-			Environment:    cmd.Environment,
-			Cluster:        cmd.Cluster,
-			ReplicationSet: cmd.ReplicationSet,
-			Username:       cmd.Username,
-			Password:       cmd.Password,
-			AgentPassword:  cmd.AgentPassword,
-			CustomLabels:   customLabels,
+			NodeID:                cmd.NodeID,
+			ServiceName:           globalFlags.serviceName,
+			Address:               globalFlags.host,
+			Socket:                globalFlags.socket,
+			Port:                  int64(globalFlags.port),
+			ExposeExporterAddress: globalFlags.exposeExporterAddress,
+			PMMAgentID:            cmd.PMMAgentID,
+			Environment:           cmd.Environment,
+			Cluster:               cmd.Cluster,
+			ReplicationSet:        cmd.ReplicationSet,
+			Username:              cmd.Username,
+			Password:              cmd.Password,
+			AgentPassword:         cmd.AgentPassword,
+			CustomLabels:          customLabels,
 
 			QANMysqlSlowlog:    cmd.QuerySource == MysqlQuerySourceSlowLog,
 			QANMysqlPerfschema: cmd.QuerySource == MysqlQuerySourcePerfSchema,

admin/commands/management/add_postgresql.go

@@ -123,7 +123,7 @@ func (cmd *AddPostgreSQLCommand) RunCmd() (commands.Result, error) {
 		}
 	}
 
-	serviceName, socket, host, port, err := processGlobalAddFlagsWithSocket(cmd, cmd.AddCommonFlags)
+	globalFlags, err := processGlobalAddFlagsWithSocket(cmd, cmd.AddCommonFlags)
 	if err != nil {
 		return nil, err
 	}
@@ -171,16 +171,16 @@ func (cmd *AddPostgreSQLCommand) RunCmd() (commands.Result, error) {
 
 	params := &postgresql.AddPostgreSQLParams{
 		Body: postgresql.AddPostgreSQLBody{
-			NodeID:      cmd.NodeID,
-			ServiceName: serviceName,
-
-			Address:                host,
-			Port:                   int64(port),
+			NodeID:                 cmd.NodeID,
+			ServiceName:            globalFlags.serviceName,
+			Address:                globalFlags.host,
+			Socket:                 globalFlags.socket,
+			Port:                   int64(globalFlags.port),
+			ExposeExporterAddress:  globalFlags.exposeExporterAddress,
 			Username:               cmd.Username,
 			Password:               cmd.Password,
 			Database:               cmd.Database,
 			AgentPassword:          cmd.AgentPassword,
-			Socket:                 socket,
 			SkipConnectionCheck:    cmd.SkipConnectionCheck,
 			DisableCommentsParsing: disableCommentsParsing,
 

admin/commands/management/add_proxysql.go

@@ -114,7 +114,7 @@ func (cmd *AddProxySQLCommand) RunCmd() (commands.Result, error) {
 		}
 	}
 
-	serviceName, socket, host, port, err := processGlobalAddFlagsWithSocket(cmd, cmd.AddCommonFlags)
+	globalFlags, err := processGlobalAddFlagsWithSocket(cmd, cmd.AddCommonFlags)
 	if err != nil {
 		return nil, err
 	}
@@ -127,18 +127,19 @@ func (cmd *AddProxySQLCommand) RunCmd() (commands.Result, error) {
 
 	params := &proxysql.AddProxySQLParams{
 		Body: proxysql.AddProxySQLBody{
-			NodeID:         cmd.NodeID,
-			ServiceName:    serviceName,
-			Address:        host,
-			Port:           int64(port),
-			Socket:         socket,
-			PMMAgentID:     cmd.PMMAgentID,
-			Environment:    cmd.Environment,
-			Cluster:        cmd.Cluster,
-			ReplicationSet: cmd.ReplicationSet,
-			Username:       cmd.Username,
-			Password:       cmd.Password,
-			AgentPassword:  cmd.AgentPassword,
+			NodeID:                cmd.NodeID,
+			ServiceName:           globalFlags.serviceName,
+			Address:               globalFlags.host,
+			Socket:                globalFlags.socket,
+			Port:                  int64(globalFlags.port),
+			ExposeExporterAddress: globalFlags.exposeExporterAddress,
+			PMMAgentID:            cmd.PMMAgentID,
+			Environment:           cmd.Environment,
+			Cluster:               cmd.Cluster,
+			ReplicationSet:        cmd.ReplicationSet,
+			Username:              cmd.Username,
+			Password:              cmd.Password,
+			AgentPassword:         cmd.AgentPassword,
 
 			CustomLabels:        customLabels,
 			SkipConnectionCheck: cmd.SkipConnectionCheck,

admin/commands/management/add_test.go

@@ -122,13 +122,13 @@ func TestManagementGlobalFlags(t *testing.T) {
 				},
 			}
 
-			serviceName, socket, address, port, err := processGlobalAddFlagsWithSocket(cmd, cmd.AddCommonFlags)
+			globalFlags, err := processGlobalAddFlagsWithSocket(cmd, cmd.AddCommonFlags)
 
 			assert.NoError(t, err)
-			assert.Equal(t, serviceName, test.wantServiceName)
-			assert.Equal(t, address, test.wantHost)
-			assert.Equal(t, int(port), int(test.wantPort))
-			assert.Equal(t, socket, test.wantSocket)
+			assert.Equal(t, globalFlags.serviceName, test.wantServiceName)
+			assert.Equal(t, globalFlags.host, test.wantHost)
+			assert.Equal(t, int(globalFlags.port), int(test.wantPort))
+			assert.Equal(t, globalFlags.socket, test.wantSocket)
 		})
 	}
 }

agent/commands/clients.go

@@ -194,9 +194,10 @@ func serverRegister(cfgSetup *config.Setup) (agentID, token string, _ error) { /
 			CustomLabels:  customLabels,
 			AgentPassword: cfgSetup.AgentPassword,
 
-			Reregister:        cfgSetup.Force,
-			MetricsMode:       pointer.ToString(strings.ToUpper(cfgSetup.MetricsMode)),
-			DisableCollectors: disableCollectors,
+			Reregister:            cfgSetup.Force,
+			MetricsMode:           pointer.ToString(strings.ToUpper(cfgSetup.MetricsMode)),
+			DisableCollectors:     disableCollectors,
+			ExposeExporterAddress: cfgSetup.ExposeExporterAddress,
 		},
 		Context: context.Background(),
 	})

agent/config/config.go

@@ -135,8 +135,9 @@ type Setup struct {
 	CustomLabels      string
 	AgentPassword     string
 
-	Force            bool
-	SkipRegistration bool
+	Force                 bool
+	SkipRegistration      bool
+	ExposeExporterAddress bool
 }
 
 // Config represents pmm-agent's configuration.
@@ -479,6 +480,8 @@ func Application(cfg *Config) (*kingpin.Application, *string) {
 		Envar("PMM_AGENT_SETUP_CUSTOM_LABELS").StringVar(&cfg.Setup.CustomLabels)
 	setupCmd.Flag("agent-password", "Custom password for /metrics endpoint [PMM_AGENT_SETUP_NODE_PASSWORD]").
 		Envar("PMM_AGENT_SETUP_NODE_PASSWORD").StringVar(&cfg.Setup.AgentPassword)
+	setupCmd.Flag("expose-exporter-address", "Expose the address of the agents node-exporter publicly on 0.0.0.0").
+		Envar("PMM_AGENT_EXPOSE_EXPORTER_ADDRESS").BoolVar(&cfg.Setup.ExposeExporterAddress)
 
 	return app, configFileF
 }