mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

gateway: cache authelia's 200 verdicts on the log and metric ingest routes

Browse source
This commit is contained in:
atlas 2026-11-14 22:05:08 +01:00
commit f5e99fe248
1 changed files with 167 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/4-implementation/swarm/telemetry.md
View file

@ -124,6 +124,8 @@ vhost does it:
any other session or client there, operators included.
- **Every other path**, the store's write and admin API included: 403.
The gateway remembers authelia's answer for the collector's push route. It keys the answer on the request's `Authorization` header and the route, keeps only a 200, and keeps it for 60 seconds. A burst of pushes from one token costs authelia one subrequest, and a push that finds its verdict in the cache doesn't wait on authelia, however slow it is. A 401 or 403 always goes to authelia again. A request without an `Authorization` header skips the cache, and the subrequest drops the `Cookie` header. A revoked or expired token keeps pushing for up to 60 seconds. The `/metrics` scrape and the other routes ask authelia every time.
`swarm-metrics-auth` and `swarm-metrics-agent-auth` read the store with one
leaf, `deploy.victoriametrics.authBaoClientCertFile` / `authBaoClientKeyFile`.
Where the secret store runs on the same host, these default to the leaf it
@ -210,6 +212,8 @@ collector's client to `/metrics` and the ingest route
`/insert/opentelemetry/v1/logs`; any other session gets `deny` on both. The
read side stays open to any authenticated caller.
The log store's ingest route `/insert/opentelemetry/v1/logs` gets the same 60-second cache of authelia's 200 answers as the metrics store's push route, with the same revocation window. The log store's other routes ask authelia every time.
## Telemetry collector (OTEL)
The swarm's collector receives from every hive's own collector and is the