vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-authelia: admit only the collector anywhere on the metrics store's name

Browse source 
No access rule covered the push route on `metrics.<swarm>`, so a request
there fell to `default_policy = one_factor`: any logged-in session cookie
for the swarm could write samples into VictoriaMetrics.

The name now gets two rules with no `resources`: the collector's client
at `one_factor`, then `deny`. Only the push route and `/metrics` on that
vhost send an authelia subrequest (the read API, Grafana's datasource
included, is served with no check), and the collector is the one caller
of both, so a domain-wide pair covers them with no path or query regex
to slip past. It replaces the per-path `/metrics` pair the published
target would otherwise derive for that name. Both rules sit ahead of the
apex and store-UI rules, and authelia matches `domain` exactly, so they
shadow no other name.

Authelia 4.39.20, read from source: a rule with no `domain` wildcard
matches with `strings.EqualFold` (access_control_domain.go), an empty
`resources` or `subject` list matches everything (access_control_rule.go),
and the first matching rule wins (authorizer.go).

Fixes #5218
This commit is contained in:
atlas 2026-10-13 11:01:22 +02:00 • committed by mara
commit 223cca2b56
4 changed files with 108 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

5
docs/swarm/services.md
View file

@ -173,8 +173,9 @@ loopback, and VictoriaMetrics authenticates nothing itself. The
`metrics.<swarm-domain>` vhost forwards only the store's read API (the
Prometheus query, series, label and metadata routes, plus the vmui web UI)
without a credential. It forwards the collector's OTLP push, and the
collector's scrape of the store's own `/metrics`, only with an authelia
token, and refuses every other path, the store's write and admin
collector's scrape of the store's own `/metrics`, only for the swarm
collector's authelia client: authelia refuses any other session or client
there. It refuses every other path, the store's write and admin
API included, with 403. The bare domain redirects to vmui.
### Logs (VictoriaLogs)