Repository navigation
Added tenant_id config to send X-Scope-OrgID for Mimir - #21
Open
abd-ulbasit wants to merge 2 commits into
Open
abd-ulbasit wants to merge 2 commits into
abd-ulbasit wants to merge 2 commits into
Conversation
The trailing-whitespace hook fails on README.md line 14 since 93ba198, which turns the pre-commit CI job red for every run.
Mimir serves the Prometheus HTTP API under /prometheus and reads the tenant from the X-Scope-OrgID header. path_prefix already covers the first part, so the new prometheus.tenant_id option adds the header to every Prometheus request. Empty means no header, as before. Added a client test against an httptest server, and a README section on running cardamon against Mimir. Refs dominikhei#10
Author
|
@dominikhei, this adds a |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #10
Mimir serves the Prometheus HTTP API under
/prometheusand reads the tenant from theX-Scope-OrgIDheader.path_prefixalready covers the first part, so this addsprometheus.tenant_idand sends it asX-Scope-OrgIDon every Prometheus request (label values, rules, series, query). If it's empty no header is sent, so nothing changes for plain Prometheus.This is only the first part of #10: one run audits one tenant. Federated tenant IDs (
team-a|team-b) don't work, because Mimir's rules endpoint only accepts a single tenant, and the README says so. Matching Grafana dashboards to tenants isn't in here either; I'd like to agree on an approach with you in #10 first.What changed:
prometheus.tenant_idin the config, passed toprom.NewClientand set in the existing round tripper next to the auth headers.pkg/prom/client_test.go: runsGetAllMetricNamesagainst anhttptestserver under/prometheusand checks the header with no tenant, one tenant, a value containing|(sent unchanged), and a tenant together with a bearer token.tenant_idin the config example, a "Using cardamon with Grafana Mimir" section, and an updated Limitations paragraph.mainhas been failing on it since 93ba198.Testing:
go test -race ./...,go vet ./...,gofmt,goimportsandgolangci-lint run(v2.15.0) are clean.X-Scope-OrgIDand serves different metrics per tenant. All four endpoints got the header, each tenant only saw its own metrics, and an emptytenant_idgot a 401, as Mimir does with multi-tenancy enabled. I haven't run it against a real Mimir yet.Notes:
go teststep in CI, so the new test won't run there. Happy to add one toci.yaml, here or in a separate PR.govulncheckcurrently fails onmainbecause Go 1.25.12 has known standard library vulnerabilities. Some of them, published in October, are fixed only in Go 1.26.9+, so it needs a move to Go 1.26. This PR doesn't touch that; I can send it separately.prom.NewClientgets a fifth parameter, which changes an exported function. I don't know of anyone importing the package, but I can switch to an options struct if you'd prefer.headersmap instead oftenant_id(Thanos usesTHANOS-TENANTby default, e.g. the querier's--query.tenant-header), that's a small change.