Read Azure credentials from environment variable

[yanivroz]

Proposal

I saw in the documentation that you can obtain AWS credentials from environment varaibles:

# The AWS API keys. If blank, the environment variables `AWS_ACCESS_KEY_ID`
# and `AWS_SECRET_ACCESS_KEY` are used.
[ access_key: <string> ]
[ secret_key: <secret> ]

Any plan to support the same for Azure?
something like this:

# The Azure API keys. If blank, the environment variables `AZURE_SUBSCRIPTION_ID`,
# `AZURE_CLIENT_ID`, `AZURE_TENANT_ID`, and `AZURE_CLIENT_SECRET` are used.
[ subscription_id: <string> ]
[ tenant_id: <string> ]
[ client_id: <string> ]
[ client_secret: <secret> ]

[brian-brazil]

We recommend against using environment variables for secrets as they aren't designed for it. We also want to have just one place that configuration comes from. If the client we're using happens to this under the covers that's it's own business though.

[yanivroz]

@brian-brazil I understand your point but isn't this kind of inconsistent to have it for one type of service discovery and not for another?
Also, I believe the security issues should be left for the user to decide. After all, putting the secret in the prometheus.yml file as plain text is just as bad as keeping it as an environment variable in clear text, no? (or am I missing something?)

[brian-brazil]

We can't control the consistency of the libraries vendors provide.

Environment variables are worse than files on disk, as it's common to e.g. dump them when there's an error.

[cstyan]

@yanivroz I guess the question is whether azure has official environment variables similar to those you would use with the AWS cli: https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html#cli-quick-configuration

Even if it does, I agree with Brian.

[yanivroz]

Azure does have these official environment variables used for similar use cases: https://simple-azure.readthedocs.io/en/latest/arm.html https://github.com/banzaicloud/azure-aks-client/blob/master/README.md I just think it’s inconsistent that Prometheus supports this for AWS and not for Azure…