diff --git a/app/vmalert/README.md b/app/vmalert/README.md index 6694f43d4f..351d03a225 100644 --- a/app/vmalert/README.md +++ b/app/vmalert/README.md @@ -622,6 +622,8 @@ The shortlist of configuration flags is the following: Optional path to bearer token file to use for -datasource.url. -datasource.disableKeepAlive Whether to disable long-lived connections to the datasource. If true, disables HTTP keep-alives and will only use the connection to the server for a single HTTP request. + -datasource.headers string + Optional HTTP headers to send with each request to the corresponding -datasource.url. For example, -datasource.headers='My-Auth:foobar' would send 'My-Auth: foobar' HTTP header with every request to the corresponding -datasource.url. Multiple headers must be delimited by '^^': -datasource.headers='header1:value1^^header2:value2' -datasource.lookback duration Lookback defines how far into the past to look when evaluating queries. For example, if the datasource.lookback=5m then param "time" with value now()-5m will be added to every query. -datasource.maxIdleConnections int @@ -807,6 +809,8 @@ The shortlist of configuration flags is the following: Optional path to bearer token file to use for -remoteRead.url. -remoteRead.disablePathAppend Whether to disable automatic appending of '/api/v1/query' path to the configured -datasource.url and -remoteRead.url + -remoteRead.headers string + Optional HTTP headers to send with each request to the corresponding -remoteRead.url. For example, -remoteRead.headers='My-Auth:foobar' would send 'My-Auth: foobar' HTTP header with every request to the corresponding -remoteRead.url. Multiple headers must be delimited by '^^': -remoteRead.headers='header1:value1^^header2:value2' -remoteRead.ignoreRestoreErrors Whether to ignore errors from remote storage when restoring alerts state on startup. (default true) -remoteRead.lookback duration @@ -849,6 +853,8 @@ The shortlist of configuration flags is the following: Whether to disable automatic appending of '/api/v1/write' path to the configured -remoteWrite.url. -remoteWrite.flushInterval duration Defines interval of flushes to remote write endpoint (default 5s) + -remoteWrite.headers string + Optional HTTP headers to send with each request to the corresponding -remoteWrite.url. For example, -remoteWrite.headers='My-Auth:foobar' would send 'My-Auth: foobar' HTTP header with every request to the corresponding -remoteWrite.url. Multiple headers must be delimited by '^^': -remoteWrite.headers='header1:value1^^header2:value2' -remoteWrite.maxBatchSize int Defines defines max number of timeseries to be flushed at once (default 1000) -remoteWrite.maxQueueSize int diff --git a/app/vmalert/datasource/init.go b/app/vmalert/datasource/init.go index d18dad2208..c05a42c048 100644 --- a/app/vmalert/datasource/init.go +++ b/app/vmalert/datasource/init.go @@ -15,6 +15,10 @@ var ( "E.g. http://127.0.0.1:8428 . See also -remoteRead.disablePathAppend") appendTypePrefix = flag.Bool("datasource.appendTypePrefix", false, "Whether to add type prefix to -datasource.url based on the query type. Set to true if sending different query types to the vmselect URL.") + headers = flag.String("datasource.headers", "", "Optional HTTP headers to send with each request to the corresponding -datasource.url. "+ + "For example, -datasource.headers='My-Auth:foobar' would send 'My-Auth: foobar' HTTP header with every request to the corresponding -datasource.url. "+ + "Multiple headers must be delimited by '^^': -datasource.headers='header1:value1^^header2:value2'") + basicAuthUsername = flag.String("datasource.basicAuth.username", "", "Optional basic auth username for -datasource.url") basicAuthPassword = flag.String("datasource.basicAuth.password", "", "Optional basic auth password for -datasource.url") basicAuthPasswordFile = flag.String("datasource.basicAuth.passwordFile", "", "Optional path to basic auth password to use for -datasource.url") @@ -80,7 +84,8 @@ func Init(extraParams url.Values) (QuerierBuilder, error) { authCfg, err := utils.AuthConfig( utils.WithBasicAuth(*basicAuthUsername, *basicAuthPassword, *basicAuthPasswordFile), utils.WithBearer(*bearerToken, *bearerTokenFile), - utils.WithOAuth(*oauth2ClientID, *oauth2ClientSecret, *oauth2ClientSecretFile, *oauth2TokenURL, *oauth2Scopes)) + utils.WithOAuth(*oauth2ClientID, *oauth2ClientSecret, *oauth2ClientSecretFile, *oauth2TokenURL, *oauth2Scopes), + utils.WithHeaders(*headers)) if err != nil { return nil, fmt.Errorf("failed to configure auth: %w", err) } diff --git a/app/vmalert/remoteread/init.go b/app/vmalert/remoteread/init.go index 1b765e1244..f4db48dc45 100644 --- a/app/vmalert/remoteread/init.go +++ b/app/vmalert/remoteread/init.go @@ -14,6 +14,10 @@ var ( "state. This configuration makes sense only if `vmalert` was configured with `remoteWrite.url` before and has been successfully persisted its state. "+ "E.g. http://127.0.0.1:8428. See also -remoteRead.disablePathAppend") + headers = flag.String("remoteRead.headers", "", "Optional HTTP headers to send with each request to the corresponding -remoteRead.url. "+ + "For example, -remoteRead.headers='My-Auth:foobar' would send 'My-Auth: foobar' HTTP header with every request to the corresponding -remoteRead.url. "+ + "Multiple headers must be delimited by '^^': -remoteRead.headers='header1:value1^^header2:value2'") + basicAuthUsername = flag.String("remoteRead.basicAuth.username", "", "Optional basic auth username for -remoteRead.url") basicAuthPassword = flag.String("remoteRead.basicAuth.password", "", "Optional basic auth password for -remoteRead.url") basicAuthPasswordFile = flag.String("remoteRead.basicAuth.passwordFile", "", "Optional path to basic auth password to use for -remoteRead.url") @@ -50,7 +54,8 @@ func Init() (datasource.QuerierBuilder, error) { authCfg, err := utils.AuthConfig( utils.WithBasicAuth(*basicAuthUsername, *basicAuthPassword, *basicAuthPasswordFile), utils.WithBearer(*bearerToken, *bearerTokenFile), - utils.WithOAuth(*oauth2ClientID, *oauth2ClientSecret, *oauth2ClientSecretFile, *oauth2TokenURL, *oauth2Scopes)) + utils.WithOAuth(*oauth2ClientID, *oauth2ClientSecret, *oauth2ClientSecretFile, *oauth2TokenURL, *oauth2Scopes), + utils.WithHeaders(*headers)) if err != nil { return nil, fmt.Errorf("failed to configure auth: %w", err) } diff --git a/app/vmalert/remotewrite/init.go b/app/vmalert/remotewrite/init.go index de5c0abdbd..ba00c1a6de 100644 --- a/app/vmalert/remotewrite/init.go +++ b/app/vmalert/remotewrite/init.go @@ -14,6 +14,10 @@ var ( "and recording rules results in form of timeseries. For example, if -remoteWrite.url=http://127.0.0.1:8428 is specified, "+ "then the alerts state will be written to http://127.0.0.1:8428/api/v1/write . See also -remoteWrite.disablePathAppend") + headers = flag.String("remoteWrite.headers", "", "Optional HTTP headers to send with each request to the corresponding -remoteWrite.url. "+ + "For example, -remoteWrite.headers='My-Auth:foobar' would send 'My-Auth: foobar' HTTP header with every request to the corresponding -remoteWrite.url. "+ + "Multiple headers must be delimited by '^^': -remoteWrite.headers='header1:value1^^header2:value2'") + basicAuthUsername = flag.String("remoteWrite.basicAuth.username", "", "Optional basic auth username for -remoteWrite.url") basicAuthPassword = flag.String("remoteWrite.basicAuth.password", "", "Optional basic auth password for -remoteWrite.url") basicAuthPasswordFile = flag.String("remoteWrite.basicAuth.passwordFile", "", "Optional path to basic auth password to use for -remoteWrite.url") @@ -56,7 +60,8 @@ func Init(ctx context.Context) (*Client, error) { authCfg, err := utils.AuthConfig( utils.WithBasicAuth(*basicAuthUsername, *basicAuthPassword, *basicAuthPasswordFile), utils.WithBearer(*bearerToken, *bearerTokenFile), - utils.WithOAuth(*oauth2ClientID, *oauth2ClientSecret, *oauth2ClientSecretFile, *oauth2TokenURL, *oauth2Scopes)) + utils.WithOAuth(*oauth2ClientID, *oauth2ClientSecret, *oauth2ClientSecretFile, *oauth2TokenURL, *oauth2Scopes), + utils.WithHeaders(*headers)) if err != nil { return nil, fmt.Errorf("failed to configure auth: %w", err) } diff --git a/app/vmalert/utils/auth.go b/app/vmalert/utils/auth.go index 060b79db74..77ad69ddbc 100644 --- a/app/vmalert/utils/auth.go +++ b/app/vmalert/utils/auth.go @@ -58,3 +58,11 @@ func WithOAuth(clientID, clientSecret, clientSecretFile, tokenURL, scopes string } } } + +func WithHeaders(headers string) AuthConfigOptions { + return func(config *promauth.HTTPClientConfig) { + if headers != "" { + config.Headers = strings.Split(headers, "^^") + } + } +} diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index c347be171b..1b4abf1af0 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -15,6 +15,7 @@ The following tip changes can be tested by building VictoriaMetrics components f ## tip +* FEATURE: [vmalert](https://docs.victoriametrics.com/vmalert.html): allow configuring additional headers for `datasource.url`, `remoteWrite.url` and `remoteRead.url` URLs. See [this issue](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/2860) for details. * FEATURE: [MetricsQL](https://docs.victoriametrics.com/MetricsQL.html): execute left and right sides of certain operations in parallel. For example, `q1 or q2`, `aggr_func(q1) q2`, `q1 aggr_func(q1)`. This may improve query performance if VictoriaMetrics has enough free resources for parallel processing of both sides of the operation. See [this feature request](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/2886). * FEATURE: [vmauth](https://docs.victoriametrics.com/vmagent.html): allow duplicate username records with different passwords at configuration file. It should allow password rotation without username change. * FEATURE: add ability to push internal metrics (e.g. metrics exposed at `/metrics` page) to the configured remote storage from all the VictoriaMetrics components. See [these docs](https://docs.victoriametrics.com/#push-metrics). diff --git a/docs/vmalert.md b/docs/vmalert.md index 7c5eb39a71..39700e049d 100644 --- a/docs/vmalert.md +++ b/docs/vmalert.md @@ -626,6 +626,8 @@ The shortlist of configuration flags is the following: Optional path to bearer token file to use for -datasource.url. -datasource.disableKeepAlive Whether to disable long-lived connections to the datasource. If true, disables HTTP keep-alives and will only use the connection to the server for a single HTTP request. + -datasource.headers string + Optional HTTP headers to send with each request to the corresponding -datasource.url. For example, -datasource.headers='My-Auth:foobar' would send 'My-Auth: foobar' HTTP header with every request to the corresponding -datasource.url. Multiple headers must be delimited by '^^': -datasource.headers='header1:value1^^header2:value2' -datasource.lookback duration Lookback defines how far into the past to look when evaluating queries. For example, if the datasource.lookback=5m then param "time" with value now()-5m will be added to every query. -datasource.maxIdleConnections int @@ -811,6 +813,8 @@ The shortlist of configuration flags is the following: Optional path to bearer token file to use for -remoteRead.url. -remoteRead.disablePathAppend Whether to disable automatic appending of '/api/v1/query' path to the configured -datasource.url and -remoteRead.url + -remoteRead.headers string + Optional HTTP headers to send with each request to the corresponding -remoteRead.url. For example, -remoteRead.headers='My-Auth:foobar' would send 'My-Auth: foobar' HTTP header with every request to the corresponding -remoteRead.url. Multiple headers must be delimited by '^^': -remoteRead.headers='header1:value1^^header2:value2' -remoteRead.ignoreRestoreErrors Whether to ignore errors from remote storage when restoring alerts state on startup. (default true) -remoteRead.lookback duration @@ -853,6 +857,8 @@ The shortlist of configuration flags is the following: Whether to disable automatic appending of '/api/v1/write' path to the configured -remoteWrite.url. -remoteWrite.flushInterval duration Defines interval of flushes to remote write endpoint (default 5s) + -remoteWrite.headers string + Optional HTTP headers to send with each request to the corresponding -remoteWrite.url. For example, -remoteWrite.headers='My-Auth:foobar' would send 'My-Auth: foobar' HTTP header with every request to the corresponding -remoteWrite.url. Multiple headers must be delimited by '^^': -remoteWrite.headers='header1:value1^^header2:value2' -remoteWrite.maxBatchSize int Defines defines max number of timeseries to be flushed at once (default 1000) -remoteWrite.maxQueueSize int