allow client to set X-Scope-OrgID

[till]

This is really close to what I'd like.

We run cortex-tenant on k8s to split metrics by a label (the label is X-Scope-OrgID). Then cortex-tenant makes a request to our own in-house thing which uses basic authentication to authenticate the request, keeping the X-Scope-OrgID label that cortex-tenant added.

From reading the code, it seems like, auth-gateway sets it based on user/pass combo:
https://github.com/cortexproject/auth-gateway/blob/main/gateway/middleware.go#L56-L63

I would add a value like __ALL__ to allow the client to set it instead. Would you be open to adding this when I write the code?

[till]

Maybe instead of __ALL__, I could also make id optional.

[friedrichg]

You could just add "pass-through" as authentication in

auth-gateway/gateway/middleware.go

Line 33 in 79ee829

// add other authentication methods if necessary

And let all headers pass without removing authentication headers. I can see that as useful for other people

---

Personally I don't see why would you use cortex-tenant to just add a label. You can do that per tenant in cortex with

# List of metric relabel configurations. Note that in most situations, it is
# more effective to use metrics relabeling directly in the Prometheus server,
# e.g. remote_write.write_relabel_configs.
[metric_relabel_configs: <relabel_config...> | default = []]

https://cortexmetrics.io/docs/configuration/configuration-file/#limits_config

[till]

@friedrichg I think way simpler, than another handler. I made a PR, but let me know.

As for your other question, maybe we started using this before cortex supported it. Or we were thrown off by the comment (to better do it elsewhere). I have to admit that after all these years re-labeling in prometheus is still a bit of a blackbox to me — too easy to get it wrong.