mimir-continuous-test tool: Add basic authentication support

[wilfriedroset]

What this PR does

Added basic authentication support to mimir-continuous-testing for when Mimir is behind a gateway authenticating the calls.

Which issue(s) this PR fixes or relates to

Fixes #2105

Checklist

• Tests updated
• Documentation added
• CHANGELOG.md updated - the order of entries should be [CHANGE], [FEATURE], [ENHANCEMENT], [BUGFIX]

[56quarters]

LGTM, just one change. Thanks!

[wilfriedroset]

I've also added the support for bearer token to fully address #2105

[56quarters]

Thanks!

[jcquiles]

@wilfriedroset I have a question! How does reverse proxy work when authenticating with a bearer token, does this mean mimir doesn't do the auth but the proxy does instead? I've seen the configs in the docs, but havent been able to find an explanation on how it actually works. Thank you!

[wilfriedroset]

Mimir does not handle authentication by itself. This part is delegated to an eventual proxy placed before Mimir.
Mimir trust the http header X-Scope-OrgID, as such the proxy is responsible for authenticating the user as it sees fit and then forward the request to mimir with the correct value.

It can be as simple as a basic auth in nginx something like:

location /api/v1/push {
  auth_basic           "prometheus remote write";
  auth_basic_user_file /etc/nginx/htpasswd.write;
  proxy_pass            https://distributor$request_uri;
  proxy_set_header      X-Scope-OrgID $x_scope_orgid;
}

Where x_scope_orgid is define as a map in nginx configuration

map $remote_user $x_scope_orgid {
    foo bar;
}

[jcquiles]

Thanks @wilfriedroset for the explanation! How about when it comes to externalLabels does it preserve all labels or only certain ones such as cluster & namespace? Afaik, it only accepts specific labels.

[wilfriedroset]

The proxy (at least for nginx) does not do anything about the external labels. They are used by mimir during the deduplication process. You can find out more in the documentation: https://grafana.com/docs/mimir/latest/operators-guide/configure/configuring-high-availability-deduplication/