-
Notifications
You must be signed in to change notification settings - Fork 3.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Documentation of OrgID #525
Comments
What is multitenancy mode?
Nothing returns, don't appear to be an flags documentated. |
ping @yubozhao |
It works if I do |
It is not a bug Loki is designed with multi tenant in mind. If you are using Loki for internal use, you can turn off multi tenant support with auth_enabled to false. If you want to use the multi tenant support. There are 2 ways to do that.
|
It is documented at operation.md
|
But how do you set the header in promtail? Promtail makes the request to
the API and I don't see anything in the config there about the OrdID.
…On Mon, Apr 29, 2019, 7:46 PM Bozhao ***@***.***> wrote:
It is documented at operation.md
Authentication
Loki does not have an authentication layer. You are expected to run an
authenticating reverse proxy in front of your services, such as an Nginx
with basic auth or an OAuth2 proxy.
Multi-tenancy
Loki is a multitenant system; requests and data for tenant A are isolated
from tenant B. Requests to the Loki API should include an HTTP header
(X-Scope-OrgID) identifying the tenant for the request. Tenant IDs can be
any alphanumeric string; limiting them to 20 bytes is reasonable. To run in
multitenant mode, loki should be started with auth_enabled: true.
Loki can be run in "single-tenant" mode where the X-Scope-OrgID header is
not required. In this situation, the tenant ID is defaulted to be fake.
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
<#525 (comment)>, or mute
the thread
<https://github.com/notifications/unsubscribe-auth/AABSVGUBAXUCM5IP4FXO23LPS6XHRANCNFSM4HI7BVLQ>
.
|
Also, if Loki doesn't have an authentication layer then why is there an
auth_enabled false setting?
On Mon, Apr 29, 2019, 7:49 PM Justin Thomas <justin.thomas1@gmail.com>
wrote:
… But how do you set the header in promtail? Promtail makes the request to
the API and I don't see anything in the config there about the OrdID.
On Mon, Apr 29, 2019, 7:46 PM Bozhao ***@***.***> wrote:
> It is documented at operation.md
>
> Authentication
> Loki does not have an authentication layer. You are expected to run an
> authenticating reverse proxy in front of your services, such as an Nginx
> with basic auth or an OAuth2 proxy.
>
> Multi-tenancy
> Loki is a multitenant system; requests and data for tenant A are isolated
> from tenant B. Requests to the Loki API should include an HTTP header
> (X-Scope-OrgID) identifying the tenant for the request. Tenant IDs can be
> any alphanumeric string; limiting them to 20 bytes is reasonable. To run in
> multitenant mode, loki should be started with auth_enabled: true.
>
> Loki can be run in "single-tenant" mode where the X-Scope-OrgID header is
> not required. In this situation, the tenant ID is defaulted to be fake.
>
> —
> You are receiving this because you authored the thread.
> Reply to this email directly, view it on GitHub
> <#525 (comment)>, or mute
> the thread
> <https://github.com/notifications/unsubscribe-auth/AABSVGUBAXUCM5IP4FXO23LPS6XHRANCNFSM4HI7BVLQ>
> .
>
|
Usually authentification system are specific to companies, so if you want to run in multi tenant you should write/use a proxy that will authenticate request and forward the correct X-Scope-OrgID to Loki.
|
I don't see why support couldn't be added to promtail to specify an OrgID via config which then adds the X-Scope-OrgID header? I don't see any harm in doing this? |
I was going to do that @slim-bean. Then other things took priority |
I had resolve this problem,using the nginx-ingress annotation,so it can work well in muti-cluster scene. an example ingress for you
if your loki was runing in |
This issue has been automatically marked as stale because it has not had any activity in the past 30 days. It will be closed in 7 days if no further activity occurs. Thank you for your contributions. |
I don't understand if Loki doesn't have any kind of OrgID option, then the validation has to be done by us? Also, I have also added Loki to Nginx as a proxy to do a basic password validation, the problem now that the Docker Driver plugin for Loggging does not have any option to send the user and password, or does it? So right now, I can't find any way to secure the Loki API Edit: I finally found the solution with internal network here #1368 (comment) |
Describe the bug
Documentation in https://github.com/grafana/loki/blob/master/docs/operations.md mentions an OrgID but the config examples have no mention of org id only s3 credentials. Where do you put the orgid?
Loki is using S3 as object storage. It stores log within directories based on OrgID. For example, Logs from org faker will stored in s3://BUCKET_NAME/faker/.
Expected behavior
Documentation which is consistent.
The text was updated successfully, but these errors were encountered: