ForgeOps

Resolve prometheus error

When using Prometheus for scraping, it throws an HTTP 401 error because there are two monitor user entries in DS, one each for DS and IDM:

  • uid=monitor (cn=monitor backend) - DS built-in monitoring user

  • uid=monitor,ou=users,ou=internal,dc=openidm,dc=forgerock,dc=io - Created by IDM repo.init.json script.

To overcome this issue, delete the monitor user entry created by IDM. Don’t delete the built-in DS monitoring user, uid=monitor under cn=monitor. If your deployment has custom or legacy IDM configuration, verify that first.

  1. Set your local Kubernetes context to the namespace where the ForgeOps deployment is running.

  2. Run the forgeops info command to get the password for the directory (uid=admin) superuser.

  3. Back up the ds-idrepo data.

  4. Connect to a ds-idrepo pod in the deployment namespace:

    $ kubectl exec -it --namespace my-ns ds-idrepo-0 — bash

  5. From the pod, run ldapdelete for the exact distinguished name of the monitor user. Enter the directory superuser password when prompted.

    bash /opt/opendj/bin/ldapdelete \
  --hostname localhost \
  --port 1389 \
  --bindDN "uid=admin" \
  --useStartTls \
  --trustAll \
  --noPropertiesFile \
  "uid=monitor,ou=users,ou=internal,dc=openidm,dc=forgerock,dc=io"

  6. Verify that exact DN has been deleted, and check that the deletion has replicated to the other ds-idrepo pods.