You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+22-7
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,7 @@ this allows read multi-tenancy for projects like Prometheus, Alertmanager or Tha
7
7
8
8
This proxy does not perform authentication or authorization, this has to happen before the request reaches this proxy, allowing you to use any authN/authZ system you want. The [kube-rbac-proxy](https://github.com/brancz/kube-rbac-proxy) is an example for such an additional building block.
9
9
10
-
### Risks outside the scope of this project:
10
+
### Risks outside the scope of this project
11
11
12
12
It's not a goal for this project to solve write tenant isolation for multi-tenant Prometheus:
13
13
@@ -16,9 +16,9 @@ It's not a goal for this project to solve write tenant isolation for multi-tenan
16
16
17
17
See [Prometheus Operator](https://github.com/prometheus-operator/prometheus-operator) label enforcement, [Thanos soft/hard tenancy](https://thanos.io/tip/proposals/201812_thanos-remote-receive.md/#architecture) or [Cortex](https://cortexmetrics.io/) as example solution to that.
18
18
19
-
## Installing `prom-label-proxy`:
19
+
## Installing `prom-label-proxy`
20
20
21
-
### Docker
21
+
### Docker
22
22
23
23
We publish docker images for each release, see:
24
24
@@ -38,7 +38,22 @@ go get github.com/prometheus-community/prom-label-proxy
38
38
39
39
## How does this project work?
40
40
41
-
This application proxies the `/federate`, `/api/v1/query`, `/api/v1/query_range`, `/api/v1/series`, `/api/v1/labels`, `/api/v1/label/<name>/values`, `/api/v1/rules`, `/api/v1/alerts` Prometheus endpoints as well as `/api/v2/silences` Alertmanager endpoint and it ensures that a particular label is enforced in the particular request and response.
41
+
This application proxies the following endpoints and it ensures that a particular label is enforced in the particular request and response:
42
+
43
+
*`/federate` for GET method (Prometheus)
44
+
*`/api/v1/query_exemplars` for GET and POST methods (Prometheus)
45
+
*`/api/v1/query` for GET and POST methods (Prometheus/Thanos)
46
+
*`/api/v1/query_range` for GET and POST methods (Prometheus/Thanos)
47
+
*`/api/v1/series` for GET method (Prometheus/Thanos)
48
+
*`/api/v1/rules` for GET method (Prometheus/Thanos)
49
+
*`/api/v1/alerts` for GET method (Prometheus/Thanos)
50
+
*`/api/v2/silences` for GET and POST methods (Alertmanager)
51
+
*`/api/v2/silence/` for DELETE (Alertmanager)
52
+
53
+
When started with the `-enable-label-apis` flag, the application can also proxy the following endpoints:
54
+
55
+
*`/api/v1/labels` for GET and POST methods (Prometheus/Thanos)
56
+
*`/api/v1/label/<name>/values` for GET method (Prometheus/Thanos)
42
57
43
58
Particularly, you can run `prom-label-proxy` with label `tenant` and point to example, demo Prometheus server e.g:
44
59
@@ -55,7 +70,7 @@ Accessing demo Prometheus APIs on `127.0.0.1:8080` will now expect `tenant` quer
Once again for clarity: **this project only enforces a particular label in the respective calls to Prometheus, it in itself does not authenticate or
@@ -86,9 +101,9 @@ This is enforced for any case, whether a label matcher is specified in the origi
86
101
87
102
### Metadata endpoints
88
103
89
-
Similar to query endpoint, for metadata endpoints `/api/v1/series`, `/api/v1/labels`, `/api/v1/label/<name>/values` the proxy injects the specified label all the provided `match[]` selectors.
104
+
Similar to query endpoint, for metadata endpoints `/api/v1/series`, `/api/v1/labels`, `/api/v1/label/<name>/values` the proxy injects the specified label all the provided `match[]` selectors.
90
105
91
-
NOTE: At the moment of creation `/api/v1/labels`, `/api/v1/label/<name>/values` does not support `match[]` so they are disabled by default. Use `-enable-label-apis` flag to enable
106
+
NOTE: At the moment of creation `/api/v1/labels`, `/api/v1/label/<name>/values` does not support `match[]` so they are disabled by default. Use `-enable-label-apis` flag to enable
92
107
those (see https://github.com/prometheus/prometheus/issues/6178 for tracking development).
0 commit comments