allow prometheus metrics without basic auth

[evkuzin]

This issue was mentioned #2399 I just figured out that this is gonna be a simple PR

[jamengual]

I'm not so keen on this change, if for whatever reason atlantis is public and exposed to the internet people could see any metrics and that might be a security issue to some people

[evkuzin]

Fair enough. Maybe we could use a flag in the config for prometheus section - require auth or not. But in general I'd say people expect metrics to be isolated from main router and even if it require auth - use a separate account for metric auth only.

[jamengual]

I agree, usually people isolate this setups but we can't assume that so we need to be secure by default.

[marcelobartsch-jt]

just my two cents on this, other option is to expose metrics in a different port, so that port can be exposed with a different configuration , for example inside a kubernetes cluster only with a service where is normally metrics don't use auth?

[nitrocode]

@evkuzin what are your thoughts on exposing metrics on a separate port instead of removing auth?

@marcelobartsch if metrics were exposed on a different port wouldn't it still need to be excluded from auth?

How are current devs getting metrics if authentication is enforced on the metrics endpoint?

[jamengual]

After talking about it we decided to not include this. the metrics have private information that could leak and Atlantis should always take the secure first approach.