vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

grafana: query the log store with the metrics bearer, by its swarm name

Browse source 
Grafana's VictoriaLogs datasource now targets https://logs.<swarm> and sends
the same static bearer as the metrics datasource. The log store's vhost routes
a 64-hex Authorization bearer to a second swarm-metrics-auth instance
(swarm-logs-grafana-auth, cert role swarm-logs-auth, which gains a read on the
bearer's store path). swarm-agent. tokens and everything else keep their routes.

Part of #3742 (DoD 3, logs).
This commit is contained in:
atlas 2026-10-16 01:32:24 +02:00 • committed by mara
commit eff5c43bdc
9 changed files with 200 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

22
nix/host-modules/swarm-grafana.nix
View file

@ -274,8 +274,10 @@ let
# The bearer the metrics datasource presents at the metrics store's query
# API, which `swarm-metrics-auth` on the store's host checks against the
# same store path. Minted once by `swarm-bao-grafana-metrics-bearer` below,
# under the same grant as the admin password. The file holds the whole
# same store path, and the logs datasource at the log store's query API,
# which a second `swarm-metrics-auth` instance in ./swarm-victorialogs.nix
# checks against it. Minted once by `swarm-bao-grafana-metrics-bearer`
# below, under the same grant as the admin password. The file holds the whole
# header value, `Bearer <value>`: nixpkgs accepts a `secureJsonData` entry
# only when it is exactly one `$__file{}`.
metricsBearerStorePath = "secret/swarm/services/${cfg.oidc.clientId}/metrics/bearer";
@ -371,16 +373,20 @@ in
logsDatasourceUrl = lib.mkOption {
type = lib.types.str;
default = "http://127.0.0.1:${toString hyperhiveCfg.swarm.victorialogs.port}";
defaultText = lib.literalExpression ''"http://127.0.0.1:''${toString services.hyperhive.swarm.victorialogs.port}"'';
default = "https://${hyperhiveCfg.swarm.victorialogs.domain}";
defaultText = lib.literalExpression ''"https://''${services.hyperhive.swarm.victorialogs.domain}"'';
description = ''
Where the provisioned logs datasource points. Defaults to the log
store on this host, which binds loopback, so this default reaches
it only where Grafana and the store share a host.
store's swarm name, served by the gateway of whichever host runs the
store, so Grafana and the store need not share a host.
Provisioned unconditionally, like the metrics datasource — the store
being off is a deployment choice rather than a reason to withhold the
connection, and an operator whose logs live elsewhere sets this.
The datasource sends the same bearer as the metrics one, which the
store's `/select/logsql/` route checks. Whatever URL this names
receives that bearer.
'';
};
@ -1316,7 +1322,11 @@ in
# not in the pipeline.
jsonData = {
inherit logLevelRules;
httpHeaderName1 = "Authorization";
};
# The metrics datasource's bearer; the log store's vhost
# accepts it on `/select/logsql/`.
secureJsonData.httpHeaderValue1 = "$__file{${metricsBearerPath}}";
}
];
};