thanos-io / thanos

Security Considerations - thanos-io/thanos

Thanos is a highly available Prometheus setup with long-term storage capabilities. The project follows best programming practices, including heavy testing, vetting, and static analysis tools on every pull request. Secure protocols are used for building processes, such as when producing Docker images.

Security Considerations:

  1. Data Storage: Thanos does not encrypt metrics in local storage (i.e., on disk) or use client-side encryption for object storage. It is recommended to set server-side encryption for object storage.

  2. Communication: Thanos always uses TLS by default for communication with all object storages.

  3. Authorization and TLS: Thanos does not allow specifying authorization or TLS for Thanos server HTTP APIs.

  4. Dependencies: Thanos uses only FLOSS tools and stable Go versions to build its images and binaries.

  5. Vulnerabilities: If a security vulnerability is encountered, it should be reported privately to the Thanos Team email address.

  6. Authentication, Authorization, and Encryption: Prometheus has a security model that describes general security assumptions and attack vectors. It includes information on automated security scanners, Prometheus, Alertmanager, Pushgateway, Exporters, Client Libraries, Authentication, Authorization, and Encryption, API Security, Secrets, Denial of Service, Libraries, Build Process, Prometheus-Community, and External audits.

The Thanos community is expected to follow the values defined in the CNCF charter, including the CNCF Code of Conduct. Material changes to this document are discussed publicly on the Thanos GitHub, and any change requires a supermajority in favor.

Sources: