Proposal

Feature Request

Description:
Currently, a user has to explicitly type in the sensitive data in the configuration yaml. For example, in case of basic_auth, the user needs to configure the username and password. In our organization username is also considered as sensitive data and configuring it in this way is not acceptable.

In grafana, there is an option(called as File Provider) to provide a path to a file for an value using a placeholder like $__file{<path_to_file>}. At the runtime, the content of the file is read and substituted for the variable dynamically.

Advantages

1. In Kubernetes environment especially, the sensitive data can be made as secrets and mounted on the pod as files. And the placeholders in prometheus configuration can be dynamically updated with the contents of the respective files and then application is started.
2. Any field in the configuration yaml can be treated as sensitive data by the organizations. Gives them better flexibility.

Example Usage in configuration

- job_name: 'health_checks'
   scrape_interval: 4m
   scrape_timeout: 25s
   static_configs:
       - targets: ['organization.com']
   metrics_path: "/api/health"
   basic_auth:
     username: $__file{/etc/secret/username}
     password: $__file{/etc/secret/password}

Contribution

I am working on the changes for this feature and if you would allow, I would be happy to contribute this back to the Prometheus community.