Merge branch 'v1.3'

CHANGELOG.md

@@ -1,8 +1,6 @@
 # Changelog
 
-## Unreleased [unreleased]
-
-### Features
+## v1.3.3 [2017-08-11]
 
 - [#1413](https://github.com/influxdata/kapacitor/issues/1413): Add subscriptions modes to InfluxDB subscriptions.
 - [#1436](https://github.com/influxdata/kapacitor/issues/1436): Add linear fill support for QueryNode.
@@ -13,6 +11,7 @@
 - [#1497](https://github.com/influxdata/kapacitor/pull/1497): Add support for Docker Swarm autoscaling services.
 
 ### Bugfixes
+- [#1520](https://github.com/influxdata/kapacitor/pull/1520): Expose pprof without authentication if enabled
 
 - [#1400](https://github.com/influxdata/kapacitor/issues/1400): Allow for `.yml` file extensions in `define-topic-handler`
 - [#1402](https://github.com/influxdata/kapacitor/pull/1402): Fix http server error logging.

services/httpd/handler.go

@@ -63,13 +63,15 @@ type Route struct {
 	HandlerFunc interface{}
 	NoGzip      bool
 	NoJSON      bool
+	BypassAuth  bool
 }
 
 // Handler represents an HTTP handler for the Kapacitor API server.
 type Handler struct {
 	methodMux map[string]*ServeMux
 
 	requireAuthentication bool
+	exposePprof           bool
 	sharedSecret          string
 
 	allowGzip bool
@@ -101,6 +103,7 @@ type Handler struct {
 // NewHandler returns a new instance of handler with routes.
 func NewHandler(
 	requireAuthentication,
+	pprofEnabled,
 	loggingEnabled,
 	writeTrace,
 	allowGzip bool,
@@ -112,6 +115,7 @@ func NewHandler(
 	h := &Handler{
 		methodMux:             make(map[string]*ServeMux),
 		requireAuthentication: requireAuthentication,
+		exposePprof:           pprofEnabled,
 		sharedSecret:          sharedSecret,
 		allowGzip:             allowGzip,
 		logger:                l,
@@ -203,35 +207,41 @@ func NewHandler(
 			Pattern:     BasePath + "/debug/pprof/",
 			HandlerFunc: servePprof,
 			NoJSON:      true,
+			BypassAuth:  true,
 		},
 		{
 			Method:      "GET",
 			Pattern:     BasePath + "/debug/pprof/cmdline",
 			HandlerFunc: pprof.Cmdline,
 			NoJSON:      true,
+			BypassAuth:  true,
 		},
 		{
 			Method:      "GET",
 			Pattern:     BasePath + "/debug/pprof/profile",
 			HandlerFunc: pprof.Profile,
 			NoJSON:      true,
+			BypassAuth:  true,
 		},
 		{
 			Method:      "GET",
 			Pattern:     BasePath + "/debug/pprof/symbol",
 			HandlerFunc: pprof.Symbol,
 			NoJSON:      true,
+			BypassAuth:  true,
 		},
 		{
 			Method:      "GET",
 			Pattern:     BasePath + "/debug/pprof/trace",
 			HandlerFunc: pprof.Trace,
 			NoJSON:      true,
+			BypassAuth:  true,
 		},
 		{
 			Method:      "GET",
 			Pattern:     BasePath + "/debug/vars",
 			HandlerFunc: serveExpvar,
+			BypassAuth:  true,
 		},
 	})
 
@@ -294,7 +304,11 @@ func (h *Handler) addRawRoute(r Route) error {
 
 	// This is a normal handler signature so perform standard authentication/authorization.
 	if hf, ok := r.HandlerFunc.(func(http.ResponseWriter, *http.Request)); ok {
-		handler = authenticate(authorize(hf), h, h.requireAuthentication)
+		requireAuth := h.requireAuthentication
+		if r.BypassAuth && h.exposePprof {
+			requireAuth = false
+		}
+		handler = authenticate(authorize(hf), h, requireAuth)
 	}
 	if handler == nil {
 		return errors.New("route does not have valid handler function")

services/httpd/httpdtest/server.go

@@ -20,6 +20,7 @@ func NewServer(verbose bool) *Server {
 	ls := loggingtest.New()
 	s := &Server{
 		Handler: httpd.NewHandler(
+			false,
 			false,
 			verbose,
 			verbose,

services/httpd/service.go

@@ -61,6 +61,7 @@ func NewService(c Config, hostname string, l *log.Logger, li logging.Interface)
 		shutdownTimeout: time.Duration(c.ShutdownTimeout),
 		Handler: NewHandler(
 			c.AuthEnabled,
+			c.PprofEnabled,
 			c.LogEnabled,
 			c.WriteTracing,
 			c.GZIP,