Skip to content

Commit f39b24f

Browse files
benjaminhuobenjaminhuo
authored
Merge pull request #1224 from raynay-r/add-bearer-token-auth-for-loki
Add bearer token auth for loki
2 parents 8e9bae2 + f11d4c1 commit f39b24f

File tree

18 files changed

+375
-3
lines changed

18 files changed

+375
-3
lines changed

‎apis/fluentbit/v1alpha2/plugins/output/loki_types.go‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,16 @@ type Loki struct {
1919
// +kubebuilder:validation:Minimum:=1
2020
// +kubebuilder:validation:Maximum:=65535
2121
Port *int32 `json:"port,omitempty"`
22+
// Specify a custom HTTP URI. It must start with forward slash.
23+
Uri string `json:"uri,omitempty"`
2224
// Set HTTP basic authentication user name.
2325
HTTPUser *plugins.Secret `json:"httpUser,omitempty"`
2426
// Password for user defined in HTTP_User
2527
// Set HTTP basic authentication password
2628
HTTPPasswd *plugins.Secret `json:"httpPassword,omitempty"`
29+
// Set bearer token authentication token value.
30+
// Can be used as alterntative to HTTP basic authentication
31+
BearerToken *plugins.Secret `json:"bearerToken,omitempty"`
2732
// Tenant ID used by default to push logs to Loki.
2833
// If omitted or empty it assumes Loki is running in single-tenant mode and no X-Scope-OrgID header is sent.
2934
TenantID *plugins.Secret `json:"tenantID,omitempty"`
@@ -70,6 +75,9 @@ func (l *Loki) Params(sl plugins.SecretLoader) (*params.KVs, error) {
7075
if l.Port != nil {
7176
kvs.Insert("port", fmt.Sprint(*l.Port))
7277
}
78+
if l.Uri != "" {
79+
kvs.Insert("uri", l.Uri)
80+
}
7381
if l.HTTPUser != nil {
7482
u, err := sl.LoadSecret(*l.HTTPUser)
7583
if err != nil {
@@ -84,6 +92,13 @@ func (l *Loki) Params(sl plugins.SecretLoader) (*params.KVs, error) {
8492
}
8593
kvs.Insert("http_passwd", pwd)
8694
}
95+
if l.BearerToken != nil {
96+
bearerToken, err := sl.LoadSecret(*l.BearerToken)
97+
if err != nil {
98+
return nil, err
99+
}
100+
kvs.Insert("bearer_token", bearerToken)
101+
}
87102
if l.TenantID != nil {
88103
id, err := sl.LoadSecret(*l.TenantID)
89104
if err != nil {

‎apis/fluentbit/v1alpha2/plugins/output/zz_generated.deepcopy.go‎

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎apis/fluentd/v1alpha1/plugins/output/loki.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ type Loki struct {
1313
// Password for user defined in HTTP_User
1414
// Set HTTP basic authentication password
1515
HTTPPasswd *plugins.Secret `json:"httpPassword,omitempty"`
16+
// Set path to file with bearer authentication token
17+
// Can be used as alterntative to HTTP basic authentication
18+
BearerTokenFile *string `json:"bearerTokenFile,omitempty"`
1619
// Tenant ID used by default to push logs to Loki.
1720
// If omitted or empty it assumes Loki is running in single-tenant mode and no X-Scope-OrgID header is sent.
1821
TenantID *plugins.Secret `json:"tenantID,omitempty"`

‎apis/fluentd/v1alpha1/plugins/output/types.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -714,6 +714,9 @@ func (o *Output) lokiPlugin(parent *params.PluginStore, loader plugins.SecretLoa
714714
}
715715
parent.InsertPairs("password", passwd)
716716
}
717+
if o.Loki.BearerTokenFile != nil {
718+
parent.InsertPairs("bearer_token_file", fmt.Sprint(*o.Loki.BearerTokenFile))
719+
}
717720
if o.Loki.TenantID != nil {
718721
id, err := loader.LoadSecret(*o.Loki.TenantID)
719722
if err != nil {

‎charts/fluent-operator/charts/fluent-bit-crds/crds/fluentbit.fluent.io_clusteroutputs.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1979,6 +1979,37 @@ spec:
19791979
- "on"
19801980
- "off"
19811981
type: string
1982+
bearerToken:
1983+
description: |-
1984+
Set bearer token authentication token value.
1985+
Can be used as alterntative to HTTP basic authentication
1986+
properties:
1987+
valueFrom:
1988+
description: ValueSource defines how to find a value's key.
1989+
properties:
1990+
secretKeyRef:
1991+
description: Selects a key of a secret in the pod's namespace
1992+
properties:
1993+
key:
1994+
description: The key of the secret to select from. Must
1995+
be a valid secret key.
1996+
type: string
1997+
name:
1998+
description: |-
1999+
Name of the referent.
2000+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
2001+
TODO: Add other useful fields. apiVersion, kind, uid?
2002+
type: string
2003+
optional:
2004+
description: Specify whether the Secret or its key
2005+
must be defined
2006+
type: boolean
2007+
required:
2008+
- key
2009+
type: object
2010+
x-kubernetes-map-type: atomic
2011+
type: object
2012+
type: object
19822013
dropSingleKey:
19832014
description: If set to true and after extracting labels only a
19842015
single key remains, the log line sent to Loki will be the value
@@ -2249,6 +2280,10 @@ spec:
22492280
description: Hostname to be used for TLS SNI extension
22502281
type: string
22512282
type: object
2283+
uri:
2284+
description: Specify a custom HTTP URI. It must start with forward
2285+
slash.
2286+
type: string
22522287
required:
22532288
- host
22542289
type: object

‎charts/fluent-operator/charts/fluent-bit-crds/crds/fluentbit.fluent.io_outputs.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1979,6 +1979,37 @@ spec:
19791979
- "on"
19801980
- "off"
19811981
type: string
1982+
bearerToken:
1983+
description: |-
1984+
Set bearer token authentication token value.
1985+
Can be used as alterntative to HTTP basic authentication
1986+
properties:
1987+
valueFrom:
1988+
description: ValueSource defines how to find a value's key.
1989+
properties:
1990+
secretKeyRef:
1991+
description: Selects a key of a secret in the pod's namespace
1992+
properties:
1993+
key:
1994+
description: The key of the secret to select from. Must
1995+
be a valid secret key.
1996+
type: string
1997+
name:
1998+
description: |-
1999+
Name of the referent.
2000+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
2001+
TODO: Add other useful fields. apiVersion, kind, uid?
2002+
type: string
2003+
optional:
2004+
description: Specify whether the Secret or its key
2005+
must be defined
2006+
type: boolean
2007+
required:
2008+
- key
2009+
type: object
2010+
x-kubernetes-map-type: atomic
2011+
type: object
2012+
type: object
19822013
dropSingleKey:
19832014
description: If set to true and after extracting labels only a
19842015
single key remains, the log line sent to Loki will be the value
@@ -2249,6 +2280,10 @@ spec:
22492280
description: Hostname to be used for TLS SNI extension
22502281
type: string
22512282
type: object
2283+
uri:
2284+
description: Specify a custom HTTP URI. It must start with forward
2285+
slash.
2286+
type: string
22522287
required:
22532288
- host
22542289
type: object

‎charts/fluent-operator/charts/fluentd-crds/crds/fluentd.fluent.io_clusteroutputs.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1914,6 +1914,11 @@ spec:
19141914
loki:
19151915
description: out_loki plugin
19161916
properties:
1917+
bearerTokenFile:
1918+
description: |-
1919+
Set path to file with bearer authentication token
1920+
Can be used as alterntative to HTTP basic authentication
1921+
type: string
19171922
dropSingleKey:
19181923
description: If a record only has 1 key, then just set the
19191924
log line to the value and discard the key.

‎charts/fluent-operator/charts/fluentd-crds/crds/fluentd.fluent.io_outputs.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1914,6 +1914,11 @@ spec:
19141914
loki:
19151915
description: out_loki plugin
19161916
properties:
1917+
bearerTokenFile:
1918+
description: |-
1919+
Set path to file with bearer authentication token
1920+
Can be used as alterntative to HTTP basic authentication
1921+
type: string
19171922
dropSingleKey:
19181923
description: If a record only has 1 key, then just set the
19191924
log line to the value and discard the key.

‎charts/fluent-operator/templates/fluentbit-output-loki.yaml‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,15 @@
55

66
{{ with .Values.fluentbit.output.loki -}}
77
{{/*
8-
When http{User,Password} or tenantID is a string, make a secret for them
8+
When http{User,Password}, bearerToken, or tenantID is a string, make a secret for them
99
When these keys are objects, they specify a secret to use generated elsewhere, assumed to exist in the k8s cluster
1010
*/}}
1111
{{ $userSecret := "loki-http-auth" -}}
1212
{{ $passSecret := "loki-http-pass" -}}
13+
{{ $bearerTokenSecret := "loki-bearer-token" -}}
1314
{{ $tenantIDSecret := "loki-tenant-id" -}}
1415

15-
{{ range $k, $v := dict $userSecret .httpUser $passSecret .httpPassword $tenantIDSecret .tenantID -}}
16+
{{ range $k, $v := dict $userSecret .httpUser $passSecret .httpPassword $tenantIDSecret .tenantID $bearerTokenSecret .bearerToken -}}
1617
{{ if kindIs "string" $v -}}
1718
---
1819
apiVersion: v1
@@ -81,6 +82,19 @@ spec:
8182
{{- end }}
8283
{{- end }}
8384

85+
{{- if .bearerToken }}
86+
bearerToken:
87+
{{- if kindIs "string" .bearerToken }}
88+
valueFrom:
89+
secretKeyRef:
90+
key: 'value'
91+
name: {{ $bearerTokenSecret }}
92+
optional: false
93+
{{- else }}
94+
{{ .bearerToken | toYaml | indent 6 }}
95+
{{- end }}
96+
{{- end }}
97+
8498
{{- if .tenantID }}
8599
tenantID:
86100
{{- if kindIs "string" .tenantID }}

‎charts/fluent-operator/values.yaml‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -278,7 +278,7 @@ fluentbit:
278278
# See https://docs.fluentbit.io/manual/pipeline/outputs/loki
279279
loki:
280280
# Switch for generation of fluentbit loki ClusterOutput (and loki basic auth http user and pass secrets if required)
281-
enable: false # Bool
281+
enable: false # Bool
282282
host: 127.0.0.1 # String
283283
port: 3100 # Int
284284
# Either, give http{User,Password},tenantID string values specifying them directly
@@ -305,6 +305,15 @@ fluentbit:
305305
# name: tenantsecret
306306
# optional: true
307307
#
308+
# To use bearer token auth instead of http basic auth
309+
#bearerToken: ey....
310+
# or with existing secret
311+
#bearerToken:
312+
# valueFrom:
313+
# secretKeyRef:
314+
# key: value
315+
# name: bearerTokenSecret
316+
# optional: true
308317
#labels: [] # String list of <name>=<value>
309318
#labelKeys: [] # String list of <key>
310319
#removeKeys: [] # String list of <key>

0 commit comments

Comments
 (0)