Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Provide label value by http header #118

Merged

Conversation

jkroepke
Copy link
Member

@jkroepke jkroepke commented Jul 5, 2022

Fixes #117

Closes #64

@jkroepke jkroepke force-pushed the restrict-by-header branch from 92260f3 to df5bf16 Compare July 5, 2022 06:07
@kfox1111
Copy link

Can we get this merged? Would be very useful.

@jkroepke
Copy link
Member Author

@squat could you take a look here?

@ThisIsQasim
Copy link
Contributor

Tagging all owners since there have been related PRs (#54 #64 #117 ) with the same feature pending for quite a while.

@brancz @krasi-georgiev @metalmatze @paulfantom @pgier @s-urbaniak @simonpasquier @squat @lilic

@jkroepke
Copy link
Member Author

@fpetkovski maybe?

@Atomique
Copy link

Atomique commented Dec 1, 2022

Would also be interested into this. Also into a new release because the actual 0.5.0 doesnt support the -values parameter (only the version in main does this).

injectproxy/routes.go Outdated Show resolved Hide resolved
injectproxy/routes.go Outdated Show resolved Hide resolved
Copy link
Contributor

@simonpasquier simonpasquier left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd expect that users pass the name of the header from the command-line (e.g. --header). And one of --query-param and --header needs to be not empty.

For backward-compatibility and principle of least surprise, the default value of --header should be "" IMHO. Thus when you upgrade to the latest version, it doesn't become automatically possible to pass the label value via HTTP header (existing setups might not filter HTTP headers so end-users could bypass prom-label-proxy's enforcement).

README.md Outdated Show resolved Hide resolved
@jkroepke jkroepke force-pushed the restrict-by-header branch 2 times, most recently from 9061642 to ad66af2 Compare December 3, 2022 22:19
Copy link
Contributor

@simonpasquier simonpasquier left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we go the route of adding a --query-param flag (which is fine by me because more explicit), I think that we should deprecate the --label flag.

injectproxy/routes.go Outdated Show resolved Hide resolved
main.go Outdated Show resolved Hide resolved
injectproxy/routes.go Outdated Show resolved Hide resolved
README.md Outdated Show resolved Hide resolved
@jkroepke jkroepke force-pushed the restrict-by-header branch 2 times, most recently from 680a19e to 6d03f0d Compare December 9, 2022 22:41
@jkroepke jkroepke requested review from simonpasquier and fpetkovski and removed request for simonpasquier and fpetkovski December 9, 2022 22:41
@jkroepke jkroepke force-pushed the restrict-by-header branch 3 times, most recently from 824a8eb to 4e75a9a Compare December 10, 2022 08:32
@jkroepke
Copy link
Member Author

How we can proceed here?

Copy link
Contributor

@simonpasquier simonpasquier left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jkroepke sorry for the lag! I have some comments on the CLI help. I've submitted jkroepke#1 to your fork with some refactoring suggestions :)

main.go Outdated Show resolved Hide resolved
main.go Outdated Show resolved Hide resolved
main.go Outdated Show resolved Hide resolved
main.go Outdated Show resolved Hide resolved
main.go Outdated Show resolved Hide resolved
README.md Outdated Show resolved Hide resolved
@jkroepke
Copy link
Member Author

Hey @simonpasquier, I saw you suggestions, but I recommend to create an additional PR which superseeds this PR or modify to existing one. "Allow edits by maintainers" is enabled. if you have maintainer permissions on https://github.com/prometheus-community/prom-label-proxy, feel free to commit here. I wont do any refactorings, since I don't have the full golang knowledge.

@simonpasquier
Copy link
Contributor

@jkroepke can you reopen my PR on your fork and merge it then? I could have pushed my changes on top of your branch but I didn't want to do it without you being aware :)

@jkroepke
Copy link
Member Author

Hey @simonpasquier please take a look that the merge conflict now which appears now after merging the PR

@simonpasquier
Copy link
Contributor

@jkroepke sure, let me resolve this!

jkroepke and others added 5 commits December 23, 2022 13:51
Signed-off-by: Jan-Otto Kröpke <mail@jkroepke.de>

Signed-off-by: Simon Pasquier <spasquie@redhat.com>
Signed-off-by: Jan-Otto Kröpke <mail@jkroepke.de>

Signed-off-by: Simon Pasquier <spasquie@redhat.com>
The interface abstracts how the label value is extracted from the
incoming request. Currently 3 implementations are provided:
1. Get the value from the HTTP form/query parameters.
2. Get the value from the HTTP headers.
3. Get a static value.

Signed-off-by: Simon Pasquier <spasquie@redhat.com>
Co-authored-by: Simon Pasquier <spasquie@redhat.com>
Signed-off-by: Jan-Otto Kröpke <github@jkroepke.de>
Signed-off-by: Simon Pasquier <spasquie@redhat.com>
@simonpasquier
Copy link
Contributor

@fpetkovski I'd like your input on this PR. In particular there's a slight difference compared to what you implemented in #116. With this change, users have to select the method to retrieve the label value from incoming requests:

  • from the HTTP form/query parameters (-query-param or -label)
  • from the HTTP headers (-header-name)
  • statically defined (-label-value)

It isn't possible to pass -label-value and -label at the same time hence when a static label value is used, the proxy will not remove anything from the HTTP parameters. Did you have a concrete use case for cleaning up the HTTP parameters when using the static configuration?

@simonpasquier
Copy link
Contributor

It isn't possible to pass -label-value and -label at the same time hence when a static label value is used, the proxy will not remove anything from the HTTP parameters. Did you have a concrete use case for cleaning up the HTTP parameters when using the static configuration?

After discussing offline with @fpetkovski the statement above isn't correct: in the current version, the proxy will return an HTTP error code when configured with -label-value and the incoming HTTP request has a label query parameter. With this PR, the proxy configured with -label-value won't remove any HTTP query/form parameter but it sounds ok as it will be ignored anyway.

@simonpasquier simonpasquier merged commit ecd875f into prometheus-community:main Jan 4, 2023
@simonpasquier
Copy link
Contributor

thanks a lot @jkroepke for your work and patience!

@jkroepke jkroepke deleted the restrict-by-header branch January 4, 2023 09:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Restrict query by http header as alternative to URL query parameter
6 participants