Force to specify not empty secret for metrics endpoint

Signed-off-by: Gladkov Alexey <agladkov@redhat.com>
openshift · Apr 25, 2017 · 1aae28d · 1aae28d
1 parent 3271ed1
commit 1aae28d
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/images/dockerregistry/config.yml b/images/dockerregistry/config.yml
@@ -39,4 +39,7 @@ openshift:
   version: 1.0
   metrics:
     enabled: false
-    secret: TopSecretToken
+    # secret is used to authenticate to metrics endpoint. It cannot be empty.
+    # Attention! A weak secret can lead to the leakage of private data.
+    #
+    # secret: TopSecretLongToken
diff --git a/pkg/cmd/dockerregistry/dockerregistry.go b/pkg/cmd/dockerregistry/dockerregistry.go
@@ -125,6 +125,9 @@ func Execute(configFile io.Reader) {
 
 	// Registry extensions endpoint provides prometheus metrics.
 	if extraConfig.Metrics.Enabled {
+		if len(extraConfig.Metrics.Secret) == 0 {
+			context.GetLogger(app).Fatalf("openshift.metrics.secret field cannot be empty when metrics are enabled")
+		}
 		server.RegisterMetricHandler(app)
 	}