Skip to content

Commit 175d620

Browse files
junkiebevRAPSNXnschadkd7lxl
authored
Generate endpoints for X-Scope-OrgID injection (multi-tenancy) (grafana#180)
* adding optional auth-org generation code Signed-off-by: Jeff Kolb <jeff.kolb@intlfcstone.com> * Added documentation Signed-off-by: Jeff Kolb <jeff.kolb@intlfcstone.com> * Bumping version number Signed-off-by: Jeff Kolb <jeff.kolb@intlfcstone.com> * Un-Bumping version number Signed-off-by: Jeff Kolb <jeff.kolb@intlfcstone.com> * Adding changelog description Signed-off-by: Jeff Kolb <jeff.kolb@intlfcstone.com> * added alertmanager-config example, added value attributes (grafana#181) Signed-off-by: Raphael Grömmer <r.groemmer@yahoo.de> Signed-off-by: Jeff Kolb <jeff.kolb@intlfcstone.com> * Passing DCO test one hopes Signed-off-by: Jeff Kolb <jeff.kolb@intlfcstone.com> * update docs also in the tmpl file (grafana#186) Signed-off-by: ShuzZzle <niclas.schad@gmail.com> Signed-off-by: Jeff Kolb <jeff.kolb@intlfcstone.com> * add autoscaler for ingesters (grafana#182) Signed-off-by: Tom Hayward <thayward@infoblox.com> Signed-off-by: Jeff Kolb <jeff.kolb@intlfcstone.com> * define namespace in templates (grafana#184) Signed-off-by: Tom Hayward <thayward@infoblox.com> Signed-off-by: Jeff Kolb <jeff.kolb@intlfcstone.com> * fix: documentation to match helm-docs spec Signed-off-by: ShuzZzle <niclas.schad@gmail.com> * fix: auth_orgs under wrong section and use %d for http listen port Signed-off-by: ShuzZzle <niclas.schad@gmail.com> Co-authored-by: Raphael Grömmer <38243306+rgroemmer@users.noreply.github.com> Co-authored-by: Niclas Schad <niclas.schad@gmail.com> Co-authored-by: Tom Hayward <thayward@infoblox.com>
1 parent 42f02b6 commit 175d620

File tree

4 files changed

+28
-18
lines changed

4 files changed

+28
-18
lines changed

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
* [FEATURE] Add autoscaler for ingesters #182
77
* [ENHANCEMENT] Define namespace in templates #184
88
* [ENHANCEMENT] Use FQDN for memcached addresses #175
9+
* [ENHANCEMENT] Optionally generate endpoints for `X-Scope-OrgID` injection (multi-tenancy) #180
910

1011
## 0.6.0 / 2021-06-28
1112

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -580,6 +580,7 @@ Kubernetes: `^1.19.0-0`
580580
| memcached.resources | object | `{}` | |
581581
| nginx.affinity | object | `{}` | |
582582
| nginx.annotations | object | `{}` | |
583+
| nginx.config.auth_orgs | list | `[]` | (optional) List of [auth tenants](https://cortexmetrics.io/docs/guides/auth/) to set in the nginx config |
583584
| nginx.config.client_max_body_size | string | `"1M"` | |
584585
| nginx.config.dnsResolver | string | `"kube-dns.kube-system.svc.cluster.local"` | |
585586
| nginx.config.setHeaders | object | `{}` | |

‎templates/nginx/nginx-config.yaml‎

Lines changed: 24 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
{{- if .Values.nginx.enabled }}
2+
{{- $rootDomain := printf "%s.svc.%s:%d" .Release.Namespace .Values.clusterDomain (.Values.config.server.http_listen_port | int) }}
23
kind: ConfigMap
34
apiVersion: v1
45
metadata:
@@ -15,8 +16,7 @@ data:
1516
1617
events {
1718
worker_connections 4096; ## Default: 1024
18-
}
19-
19+
}
2020
2121
http {
2222
default_type application/octet-stream;
@@ -46,64 +46,71 @@ data:
4646
4747
# Distributor Config
4848
location = /ring {
49-
proxy_pass http://{{ template "cortex.fullname" . }}-distributor.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:{{ .Values.config.server.http_listen_port }}$request_uri;
49+
proxy_pass http://{{ template "cortex.fullname" . }}-distributor.{{ $rootDomain }}$request_uri;
5050
}
5151
5252
location = /all_user_stats {
53-
proxy_pass http://{{ template "cortex.fullname" . }}-distributor.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:{{ .Values.config.server.http_listen_port }}$request_uri;
53+
proxy_pass http://{{ template "cortex.fullname" . }}-distributor.{{ $rootDomain }}$request_uri;
5454
}
5555
5656
location = /api/prom/push {
57-
proxy_pass http://{{ template "cortex.fullname" . }}-distributor.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:{{ .Values.config.server.http_listen_port }}$request_uri;
57+
proxy_pass http://{{ template "cortex.fullname" . }}-distributor.{{ $rootDomain }}$request_uri;
5858
}
5959
6060
## New Remote write API. Ref: https://cortexmetrics.io/docs/api/#remote-write
6161
location = /api/v1/push {
62-
proxy_pass http://{{ template "cortex.fullname" . }}-distributor.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:{{ .Values.config.server.http_listen_port }}$request_uri;
62+
proxy_pass http://{{ template "cortex.fullname" . }}-distributor.{{ $rootDomain }}$request_uri;
6363
}
6464
65-
6665
# Alertmanager Config
6766
location ~ /api/prom/alertmanager/.* {
68-
proxy_pass http://{{ template "cortex.fullname" . }}-alertmanager.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:{{ .Values.config.server.http_listen_port }}$request_uri;
67+
proxy_pass http://{{ template "cortex.fullname" . }}-alertmanager.{{ $rootDomain }}$request_uri;
6968
}
7069
7170
location ~ /api/v1/alerts {
72-
proxy_pass http://{{ template "cortex.fullname" . }}-alertmanager.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:{{ .Values.config.server.http_listen_port }}$request_uri;
71+
proxy_pass http://{{ template "cortex.fullname" . }}-alertmanager.{{ $rootDomain }}$request_uri;
7372
}
7473
7574
location ~ /multitenant_alertmanager/status {
76-
proxy_pass http://{{ template "cortex.fullname" . }}-alertmanager.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:{{ .Values.config.server.http_listen_port }}$request_uri;
75+
proxy_pass http://{{ template "cortex.fullname" . }}-alertmanager.{{ $rootDomain }}$request_uri;
7776
}
7877
7978
# Ruler Config
8079
location ~ /api/v1/rules {
81-
proxy_pass http://{{ template "cortex.fullname" . }}-ruler.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:{{ .Values.config.server.http_listen_port }}$request_uri;
80+
proxy_pass http://{{ template "cortex.fullname" . }}-ruler.{{ $rootDomain }}$request_uri;
8281
}
8382
8483
location ~ /ruler/ring {
85-
proxy_pass http://{{ template "cortex.fullname" . }}-ruler.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:{{ .Values.config.server.http_listen_port }}$request_uri;
84+
proxy_pass http://{{ template "cortex.fullname" . }}-ruler.{{ $rootDomain }}$request_uri;
8685
}
8786
8887
# Config Config
8988
location ~ /api/prom/configs/.* {
90-
proxy_pass http://{{ template "cortex.fullname" . }}-configs.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:{{ .Values.config.server.http_listen_port }}$request_uri;
89+
proxy_pass http://{{ template "cortex.fullname" . }}-configs.{{ $rootDomain }}$request_uri;
9190
}
9291
9392
# Query Config
9493
location ~ /api/prom/.* {
95-
proxy_pass http://{{ template "cortex.fullname" . }}-query-frontend.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:{{ .Values.config.server.http_listen_port }}$request_uri;
94+
proxy_pass http://{{ template "cortex.fullname" . }}-query-frontend.{{ $rootDomain }}$request_uri;
9695
}
9796
9897
## New Query frontend APIs as per https://cortexmetrics.io/docs/api/#querier--query-frontend
9998
location ~ ^{{.Values.config.api.prometheus_http_prefix}}/api/v1/(read|metadata|labels|series|query_range|query) {
100-
proxy_pass http://{{ template "cortex.fullname" . }}-query-frontend.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:{{ .Values.config.server.http_listen_port }}$request_uri;
99+
proxy_pass http://{{ template "cortex.fullname" . }}-query-frontend.{{ $rootDomain }}$request_uri;
101100
}
102101
103102
location ~ {{.Values.config.api.prometheus_http_prefix}}/api/v1/label/.* {
104-
proxy_pass http://{{ template "cortex.fullname" . }}-query-frontend.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:{{ .Values.config.server.http_listen_port }}$request_uri;
103+
proxy_pass http://{{ template "cortex.fullname" . }}-query-frontend.{{ $rootDomain }}$request_uri;
105104
}
106-
105+
{{- if and (.Values.config.auth_enabled) (.Values.nginx.config.auth_orgs) }}
106+
# Auth orgs
107+
{{- range $org := compact .Values.nginx.config.auth_orgs | uniq }}
108+
location = /api/v1/push/{{ $org }} {
109+
proxy_set_header X-Scope-OrgID {{ $org }};
110+
proxy_pass http://{{ template "cortex.fullname" $ }}-distributor.{{ $rootDomain }}$request_uri;
111+
}
112+
{{- end }}
113+
{{- end }}
107114
}
108115
}
109116
{{- end }}

‎values.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1115,7 +1115,8 @@ nginx:
11151115
## ref: http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size
11161116
client_max_body_size: 1M
11171117
setHeaders: {}
1118-
# X-Scope-OrgID: 0
1118+
# -- (optional) List of [auth tenants](https://cortexmetrics.io/docs/guides/auth/) to set in the nginx config
1119+
auth_orgs: []
11191120
image:
11201121
repository: nginx
11211122
tag: 1.21

0 commit comments

Comments
 (0)