promtail: add multi-tenant support

[pracucci]

What this PR does / why we need it:

Promtail currently doesn't allow to specify the tenant / org ID. In this PR I've introduced three main changes:

1. Add tenant_id support to promtail client config
2. Add multi-tenant capabilities to promtail client, to be able to override the tenant ID on a per log entry basis
3. Add a tenant stage to easily override the tenant ID

Which issue(s) this PR fixes:

• Fixes Allow promtail to set X-Scope-OrgID header dynamically #259
• Fixes promtail client is not able to send orgID headers #1040

Special notes for your reviewer:

• This PR - if accepted - would replace the PR added support for orgID in promtail client #1041 (still pending)
• logcli tenant selection support is missing (if this PR will be eventually accepted, I will submit a subsequent PR for logcli)

Checklist

• Documentation added
• Tests updated

[pstibrany]

If we find support for multiple tenants without tenant-specific authentication a valid use case, this certainly looks like it would work.

[pstibrany]

This is convoluted example with constant tenant ID. If that is a useful use case, maybe tenant stage can support it directly?

[pracucci]

This originates from a comment made by @cyriltovena, where he was suggesting to add this example too (at least this is what I understood). Cyril, is this example what you meant?

[cyriltovena]

Yes because I think that's mainly how it will be used. I don't think someone has a tenant id in its log, or at least this is not the most common.

[cyriltovena]

Can the tenant stage support also a const tenant ID ? I think that's a valid use case.

[pracucci]

It does not, but it can. What do you think if we add a value field, which is mutually exclusive with source? For example:

# Here the value is hardcoded
- tenant:
    value: team-api

# Here the value is picked from tenant_id field
- tenant:
    source: tenant_id

[pracucci]

@cyriltovena Done! What's your take?

[pracucci]

Thanks @pstibrany for your feedback. I've addressed 2 out of 3 comments. May you check it out again, please?

[cyriltovena]

Works for me Le mar. 5 nov. 2019 à 12:49, Marco Pracucci <notifications@github.com> a écrit :

…

***@***.**** commented on this pull request. ------------------------------ In docs/clients/promtail/stages/tenant.md <#1135 (comment)>: > + +```yaml +pipeline_stages: + - json: + expressions: + app: + message: + - labels: + app: + - match: + selector: '{app="api"}' + stages: + - template: + source: tenant_id + template: 'team-api' + - tenant: It does not, but it can. What do you think if we add a value field, which is mutually exclusive with source? For example: # Here the value is hardcoded - tenant: value: team-api # Here the value is picked from tenant_id field - tenant: source: tenant_id — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1135?email_source=notifications&email_token=AAIBF3PFHXZWEMOOH3VR2RTQSGWZPA5CNFSM4I65PT32YY3PNVWWK3TUL52HS4DFWFIHK3DMKJSXC5LFON2FEZLWNFSXPKTDN5WW2ZLOORPWSZGOCKLXONA#discussion_r342703617>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAIBF3IEUBXCYERS6OVNECTQSGWZPANCNFSM4I65PT3Q> .

[cyriltovena]

LGTM, I don't think we need a new file for a single constant that's a nitpick.

[brancz]

Nice! 🎉