From b795672bbae89899be024484d0f1378e6a0cdcfb Mon Sep 17 00:00:00 2001 From: Thomas Belian <72987757+bt909@users.noreply.github.com> Date: Wed, 5 Oct 2022 13:42:48 +0200 Subject: [PATCH] feat(lambda-promtail): add bearer token support (#7333) It adds bearer token support for lambda-promtail, as it supports only http basic auth. Signed-off-by: Thomas Belian --- tools/lambda-promtail/README.md | 6 ++++-- tools/lambda-promtail/lambda-promtail/main.go | 18 ++++++++++++------ .../lambda-promtail/promtail.go | 4 ++++ tools/lambda-promtail/main.tf | 1 + tools/lambda-promtail/template.yaml | 6 ++++++ tools/lambda-promtail/variables.tf | 7 +++++++ 6 files changed, 34 insertions(+), 8 deletions(-) diff --git a/tools/lambda-promtail/README.md b/tools/lambda-promtail/README.md index b828657683..0dc56d0855 100644 --- a/tools/lambda-promtail/README.md +++ b/tools/lambda-promtail/README.md @@ -47,16 +47,18 @@ The `lambda-promtail` code picks this value up via an environment variable. Also, if your deployment requires a [VPC configuration](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function#vpc_config), make sure to edit the `vpc_config` field in `main.tf` manually. Additonal documentation for the Lambda specific Terraform configuration is [here](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function#vpc_config). +`lambda-promtail` supports authentication either using HTTP Basic Auth or using Bearer Token. + Then use Terraform to deploy: ```bash -terraform apply -var ":" -var "write_address=https://your-loki-url/loki/api/v1/push" -var "password=" -var "username=" -var 'log_group_names=["log-group-01", "log-group-02"]' -var 'extra_labels="name1,value1,name2,value2"' -var "tenant_id=" +terraform apply -var ":" -var "write_address=https://your-loki-url/loki/api/v1/push" -var "password=" -var "username=" -var 'bearer_token=' -var 'log_group_names=["log-group-01", "log-group-02"]' -var 'extra_labels="name1,value1,name2,value2"' -var "tenant_id=" ``` or CloudFormation: ```bash -aws cloudformation create-stack --stack-name lambda-promtail-stack --template-body file://template.yaml --capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM --region us-east-2 --parameters ParameterKey=WriteAddress,ParameterValue=https://your-loki-url/loki/api/v1/push ParameterKey=Username,ParameterValue= ParameterKey=Password,ParameterValue= ParameterKey=LambdaPromtailImage,ParameterValue=: ParameterKey=ExtraLabels,ParameterValue="name1,value1,name2,value2" ParameterKey=TenantID,ParameterValue= +aws cloudformation create-stack --stack-name lambda-promtail-stack --template-body file://template.yaml --capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM --region us-east-2 --parameters ParameterKey=WriteAddress,ParameterValue=https://your-loki-url/loki/api/v1/push ParameterKey=Username,ParameterValue= ParameterKey=Password,ParameterValue= ParameterKey=BearerToken,ParameterValue= ParameterKey=LambdaPromtailImage,ParameterValue=: ParameterKey=ExtraLabels,ParameterValue="name1,value1,name2,value2" ParameterKey=TenantID,ParameterValue= ``` # Appendix diff --git a/tools/lambda-promtail/lambda-promtail/main.go b/tools/lambda-promtail/lambda-promtail/main.go index bea917192b..58821d9be0 100644 --- a/tools/lambda-promtail/lambda-promtail/main.go +++ b/tools/lambda-promtail/lambda-promtail/main.go @@ -27,12 +27,12 @@ const ( ) var ( - writeAddress *url.URL - username, password, extraLabelsRaw, tenantID string - keepStream bool - batchSize int - s3Clients map[string]*s3.Client - extraLabels model.LabelSet + writeAddress *url.URL + username, password, extraLabelsRaw, tenantID, bearerToken string + keepStream bool + batchSize int + s3Clients map[string]*s3.Client + extraLabels model.LabelSet ) func setupArguments() { @@ -62,6 +62,12 @@ func setupArguments() { panic("both username and password must be set if either one is set") } + bearerToken = os.Getenv("BEARER_TOKEN") + // If username and password are set, bearer token is not allowed + if username != "" && bearerToken != "" { + panic("both username and bearerToken are not allowed") + } + tenantID = os.Getenv("TENANT_ID") keep := os.Getenv("KEEP_STREAM") diff --git a/tools/lambda-promtail/lambda-promtail/promtail.go b/tools/lambda-promtail/lambda-promtail/promtail.go index 5d649d4e46..afa13de4c4 100644 --- a/tools/lambda-promtail/lambda-promtail/promtail.go +++ b/tools/lambda-promtail/lambda-promtail/promtail.go @@ -185,6 +185,10 @@ func send(ctx context.Context, buf []byte) (int, error) { req.SetBasicAuth(username, password) } + if bearerToken != "" { + req.Header.Set("Authorization", "Bearer "+bearerToken) + } + resp, err := http.DefaultClient.Do(req.WithContext(ctx)) if err != nil { return -1, err diff --git a/tools/lambda-promtail/main.tf b/tools/lambda-promtail/main.tf index eff1487e07..4cfa37a010 100644 --- a/tools/lambda-promtail/main.tf +++ b/tools/lambda-promtail/main.tf @@ -102,6 +102,7 @@ resource "aws_lambda_function" "lambda_promtail" { WRITE_ADDRESS = var.write_address USERNAME = var.username PASSWORD = var.password + BEARER_TOKEN = var.bearer_token KEEP_STREAM = var.keep_stream BATCH_SIZE = var.batch_size EXTRA_LABELS = var.extra_labels diff --git a/tools/lambda-promtail/template.yaml b/tools/lambda-promtail/template.yaml index 5e15b48d5e..cd32e30611 100644 --- a/tools/lambda-promtail/template.yaml +++ b/tools/lambda-promtail/template.yaml @@ -22,6 +22,11 @@ Parameters: Type: String Default: "" NoEcho: true + BearerToken: + Description: The bearer token, necessary if target endpoint requires it. + Type: String + Default: "" + NoEcho: true LambdaPromtailImage: Description: The ECR image URI to pull and use for lambda-promtail. Type: String @@ -82,6 +87,7 @@ Resources: WRITE_ADDRESS: !Ref WriteAddress USERNAME: !Ref Username PASSWORD: !Ref Password + BEARER_TOKEN: !Ref BearerToken KEEP_STREAM: !Ref KeepStream EXTRA_LABELS: !Ref ExtraLabels TENANT_ID: !Ref TenantID diff --git a/tools/lambda-promtail/variables.tf b/tools/lambda-promtail/variables.tf index 1ecaf1fe78..0af5785180 100644 --- a/tools/lambda-promtail/variables.tf +++ b/tools/lambda-promtail/variables.tf @@ -35,6 +35,13 @@ variable "password" { default = "" } +variable "bearer_token" { + type = string + description = "The bearer token, necessary if target endpoint requires it." + sensitive = true + default = "" +} + variable "tenant_id" { type = string description = "Tenant ID to be added when writing logs from lambda-promtail."