diff --git a/app/vmagent/remotewrite/client.go b/app/vmagent/remotewrite/client.go index ffe90ae844..6d4036e5db 100644 --- a/app/vmagent/remotewrite/client.go +++ b/app/vmagent/remotewrite/client.go @@ -59,6 +59,8 @@ var ( "Multiple headers must be delimited by '^^': -remoteWrite.headers='header1:value1^^header2:value2'") basicAuthUsername = flagutil.NewArrayString("remoteWrite.basicAuth.username", "Optional basic auth username to use for the corresponding -remoteWrite.url") + basicAuthUsernameFile = flagutil.NewArrayString("remoteWrite.basicAuth.usernameFile", "Optional path to basic auth username to use for the corresponding -remoteWrite.url. "+ + "The file is re-read every second") basicAuthPassword = flagutil.NewArrayString("remoteWrite.basicAuth.password", "Optional basic auth password to use for the corresponding -remoteWrite.url") basicAuthPasswordFile = flagutil.NewArrayString("remoteWrite.basicAuth.passwordFile", "Optional path to basic auth password to use for the corresponding -remoteWrite.url. "+ "The file is re-read every second") @@ -223,12 +225,14 @@ func getAuthConfig(argIdx int) (*promauth.Config, error) { hdrs = strings.Split(headersValue, "^^") } username := basicAuthUsername.GetOptionalArg(argIdx) + usernameFile := basicAuthUsernameFile.GetOptionalArg(argIdx) password := basicAuthPassword.GetOptionalArg(argIdx) passwordFile := basicAuthPasswordFile.GetOptionalArg(argIdx) var basicAuthCfg *promauth.BasicAuthConfig - if username != "" || password != "" || passwordFile != "" { + if username != "" || usernameFile != "" || password != "" || passwordFile != "" { basicAuthCfg = &promauth.BasicAuthConfig{ Username: username, + UsernameFile: usernameFile, Password: promauth.NewSecret(password), PasswordFile: passwordFile, } diff --git a/app/vmalert/datasource/client_test.go b/app/vmalert/datasource/client_test.go index e0d072b96f..681709ab51 100644 --- a/app/vmalert/datasource/client_test.go +++ b/app/vmalert/datasource/client_test.go @@ -772,7 +772,7 @@ func TestHeaders(t *testing.T) { // basic auth f(func() *Client { - cfg, err := vmalertutil.AuthConfig(vmalertutil.WithBasicAuth("foo", "bar", "")) + cfg, err := vmalertutil.AuthConfig(vmalertutil.WithBasicAuth("foo", "", "bar", "")) if err != nil { t.Fatalf("Error get auth config: %s", err) } @@ -817,7 +817,7 @@ func TestHeaders(t *testing.T) { // custom header overrides basic auth f(func() *Client { - cfg, err := vmalertutil.AuthConfig(vmalertutil.WithBasicAuth("foo", "bar", "")) + cfg, err := vmalertutil.AuthConfig(vmalertutil.WithBasicAuth("foo", "", "bar", "")) if err != nil { t.Fatalf("Error get auth config: %s", err) } diff --git a/app/vmalert/datasource/init.go b/app/vmalert/datasource/init.go index 358a3ea34b..bb44b7d77d 100644 --- a/app/vmalert/datasource/init.go +++ b/app/vmalert/datasource/init.go @@ -27,6 +27,7 @@ var ( "Multiple headers must be delimited by '^^': -datasource.headers='header1:value1^^header2:value2'") basicAuthUsername = flag.String("datasource.basicAuth.username", "", "Optional basic auth username for -datasource.url") + basicAuthUsernameFile = flag.String("datasource.basicAuth.usernameFile", "", "Optional path to basic auth username to use for -datasource.url") basicAuthPassword = flag.String("datasource.basicAuth.password", "", "Optional basic auth password for -datasource.url") basicAuthPasswordFile = flag.String("datasource.basicAuth.passwordFile", "", "Optional path to basic auth password to use for -datasource.url") @@ -105,7 +106,7 @@ func Init(extraParams url.Values) (QuerierBuilder, error) { return nil, fmt.Errorf("cannot parse JSON for -datasource.oauth2.endpointParams=%s: %w", *oauth2EndpointParams, err) } authCfg, err := vmalertutil.AuthConfig( - vmalertutil.WithBasicAuth(*basicAuthUsername, *basicAuthPassword, *basicAuthPasswordFile), + vmalertutil.WithBasicAuth(*basicAuthUsername, *basicAuthUsernameFile, *basicAuthPassword, *basicAuthPasswordFile), vmalertutil.WithBearer(*bearerToken, *bearerTokenFile), vmalertutil.WithOAuth(*oauth2ClientID, *oauth2ClientSecret, *oauth2ClientSecretFile, *oauth2TokenURL, *oauth2Scopes, endpointParams), vmalertutil.WithHeaders(*headers)) diff --git a/app/vmalert/notifier/alertmanager.go b/app/vmalert/notifier/alertmanager.go index babf6ac1e5..baee6f452e 100644 --- a/app/vmalert/notifier/alertmanager.go +++ b/app/vmalert/notifier/alertmanager.go @@ -191,7 +191,7 @@ func NewAlertManager(alertManagerURL string, fn AlertURLGenerator, authCfg proma } aCfg, err := vmalertutil.AuthConfig( - vmalertutil.WithBasicAuth(ba.Username, ba.Password.String(), ba.PasswordFile), + vmalertutil.WithBasicAuth(ba.Username, ba.UsernameFile, ba.Password.String(), ba.PasswordFile), vmalertutil.WithBearer(authCfg.BearerToken.String(), authCfg.BearerTokenFile), vmalertutil.WithOAuth(oauth.ClientID, oauth.ClientSecret.String(), oauth.ClientSecretFile, oauth.TokenURL, strings.Join(oauth.Scopes, ";"), oauth.EndpointParams), vmalertutil.WithHeaders(strings.Join(authCfg.Headers, "^^")), diff --git a/app/vmalert/notifier/init.go b/app/vmalert/notifier/init.go index 03e3076c2a..aa30a0fabc 100644 --- a/app/vmalert/notifier/init.go +++ b/app/vmalert/notifier/init.go @@ -36,6 +36,7 @@ var ( "For example, -remoteWrite.headers='My-Auth:foobar' would send 'My-Auth: foobar' HTTP header with every request to the corresponding -notifier.url. "+ "Multiple headers must be delimited by '^^': -notifier.headers='header1:value1^^header2:value2,header3:value3'") basicAuthUsername = flagutil.NewArrayString("notifier.basicAuth.username", "Optional basic auth username for -notifier.url") + basicAuthUsernameFile = flagutil.NewArrayString("notifier.basicAuth.usernameFile", "Optional path to basic auth username file for -notifier.url") basicAuthPassword = flagutil.NewArrayString("notifier.basicAuth.password", "Optional basic auth password for -notifier.url") basicAuthPasswordFile = flagutil.NewArrayString("notifier.basicAuth.passwordFile", "Optional path to basic auth password file for -notifier.url") @@ -213,6 +214,7 @@ func notifiersFromFlags(gen AlertURLGenerator) ([]Notifier, error) { }, BasicAuth: &promauth.BasicAuthConfig{ Username: basicAuthUsername.GetOptionalArg(i), + UsernameFile: basicAuthUsernameFile.GetOptionalArg(i), Password: promauth.NewSecret(basicAuthPassword.GetOptionalArg(i)), PasswordFile: basicAuthPasswordFile.GetOptionalArg(i), }, diff --git a/app/vmalert/remoteread/init.go b/app/vmalert/remoteread/init.go index 8534962769..f43c713d3c 100644 --- a/app/vmalert/remoteread/init.go +++ b/app/vmalert/remoteread/init.go @@ -28,6 +28,7 @@ var ( "Multiple headers must be delimited by '^^': -remoteRead.headers='header1:value1^^header2:value2'") basicAuthUsername = flag.String("remoteRead.basicAuth.username", "", "Optional basic auth username for -remoteRead.url") + basicAuthUsernameFile = flag.String("remoteRead.basicAuth.usernameFile", "", "Optional path to basic auth username to use for -remoteRead.url") basicAuthPassword = flag.String("remoteRead.basicAuth.password", "", "Optional basic auth password for -remoteRead.url") basicAuthPasswordFile = flag.String("remoteRead.basicAuth.passwordFile", "", "Optional path to basic auth password to use for -remoteRead.url") @@ -80,7 +81,7 @@ func Init() (datasource.QuerierBuilder, error) { return nil, fmt.Errorf("cannot parse JSON for -remoteRead.oauth2.endpointParams=%s: %w", *oauth2EndpointParams, err) } authCfg, err := vmalertutil.AuthConfig( - vmalertutil.WithBasicAuth(*basicAuthUsername, *basicAuthPassword, *basicAuthPasswordFile), + vmalertutil.WithBasicAuth(*basicAuthUsername, *basicAuthUsernameFile, *basicAuthPassword, *basicAuthPasswordFile), vmalertutil.WithBearer(*bearerToken, *bearerTokenFile), vmalertutil.WithOAuth(*oauth2ClientID, *oauth2ClientSecret, *oauth2ClientSecretFile, *oauth2TokenURL, *oauth2Scopes, endpointParams), vmalertutil.WithHeaders(*headers)) diff --git a/app/vmalert/remotewrite/init.go b/app/vmalert/remotewrite/init.go index 40e56357df..35185c6413 100644 --- a/app/vmalert/remotewrite/init.go +++ b/app/vmalert/remotewrite/init.go @@ -26,6 +26,7 @@ var ( "Multiple headers must be delimited by '^^': -remoteWrite.headers='header1:value1^^header2:value2'") basicAuthUsername = flag.String("remoteWrite.basicAuth.username", "", "Optional basic auth username for -remoteWrite.url") + basicAuthUsernameFile = flag.String("remoteWrite.basicAuth.usernameFile", "", "Optional path to basic auth username to use for -remoteWrite.url") basicAuthPassword = flag.String("remoteWrite.basicAuth.password", "", "Optional basic auth password for -remoteWrite.url") basicAuthPasswordFile = flag.String("remoteWrite.basicAuth.passwordFile", "", "Optional path to basic auth password to use for -remoteWrite.url") @@ -83,7 +84,7 @@ func Init(ctx context.Context) (*Client, error) { return nil, fmt.Errorf("cannot parse JSON for -remoteWrite.oauth2.endpointParams=%s: %w", *oauth2EndpointParams, err) } authCfg, err := vmalertutil.AuthConfig( - vmalertutil.WithBasicAuth(*basicAuthUsername, *basicAuthPassword, *basicAuthPasswordFile), + vmalertutil.WithBasicAuth(*basicAuthUsername, *basicAuthUsernameFile, *basicAuthPassword, *basicAuthPasswordFile), vmalertutil.WithBearer(*bearerToken, *bearerTokenFile), vmalertutil.WithOAuth(*oauth2ClientID, *oauth2ClientSecret, *oauth2ClientSecretFile, *oauth2TokenURL, *oauth2Scopes, endpointParams), vmalertutil.WithHeaders(*headers)) diff --git a/app/vmalert/vmalertutil/auth.go b/app/vmalert/vmalertutil/auth.go index c64e43937b..6d8c939f26 100644 --- a/app/vmalert/vmalertutil/auth.go +++ b/app/vmalert/vmalertutil/auth.go @@ -20,11 +20,12 @@ func AuthConfig(filterOptions ...AuthConfigOptions) (*promauth.Config, error) { } // WithBasicAuth returns AuthConfigOptions and initialized promauth.BasicAuthConfig based on given params -func WithBasicAuth(username, password, passwordFile string) AuthConfigOptions { +func WithBasicAuth(username, usernameFile, password, passwordFile string) AuthConfigOptions { return func(config *promauth.HTTPClientConfig) { - if username != "" || password != "" || passwordFile != "" { + if username != "" || usernameFile != "" || password != "" || passwordFile != "" { config.BasicAuth = &promauth.BasicAuthConfig{ Username: username, + UsernameFile: usernameFile, Password: promauth.NewSecret(password), PasswordFile: passwordFile, } diff --git a/docs/victoriametrics/changelog/CHANGELOG.md b/docs/victoriametrics/changelog/CHANGELOG.md index 745e6ec35b..ec0a2a4455 100644 --- a/docs/victoriametrics/changelog/CHANGELOG.md +++ b/docs/victoriametrics/changelog/CHANGELOG.md @@ -27,6 +27,7 @@ See also [LTS releases](https://docs.victoriametrics.com/victoriametrics/lts-rel ## tip * FEATURE: all VictoriaMetrics components: improve logging for the `-memory.allowedBytes` flag to warn about excessively low value (less than 1MB). See issue [#10935](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/10935). +* FEATURE: [vmagent](https://docs.victoriametrics.com/victoriametrics/vmagent/) and [vmalert](https://docs.victoriametrics.com/victoriametrics/vmalert/): add `basicAuth.usernameFile` command-line flags for reading basic auth username from a file, similar to the existing `basicAuth.passwordFile`. The file is re-read every second. See [#9436](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/9436). Thanks to @kimjune01 for the contribution. * FEATURE: [vmsingle](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/), `vminsert` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/victoriametrics/cluster-victoriametrics/) and [vmagent](https://docs.victoriametrics.com/victoriametrics/vmagent/): add `-opentelemetry.labelNameUnderscoreSanitization` command-line flag to control whether to enable prepending of `key` to labels starting with `_` when `-opentelemetry.usePrometheusNaming` is enabled. See [OpenTelemetry](https://docs.victoriametrics.com/victoriametrics/integrations/opentelemetry/) docs and [#9663](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/9663). Thanks to @andriibeee for the contribution. * FEATURE: [vmui](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/#vmui): improve the [Top Queries](https://docs.victoriametrics.com/victoriametrics/single-server-victoriametrics/#top-queries) table UI. Duration columns now display human-readable values (e.g. `1.23s`) instead of raw seconds, memory column shows human-readable sizes (e.g. `1.23 MB`), instant queries are labeled as `instant` instead of empty string, and column headers now show tooltips with descriptions. See [#10790](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/10790). diff --git a/docs/victoriametrics/vmagent_common_flags.md b/docs/victoriametrics/vmagent_common_flags.md index 9767635006..fc9da21c83 100644 --- a/docs/victoriametrics/vmagent_common_flags.md +++ b/docs/victoriametrics/vmagent_common_flags.md @@ -383,6 +383,10 @@ See the docs at https://docs.victoriametrics.com/victoriametrics/vmagent/ . Optional basic auth username to use for the corresponding -remoteWrite.url Supports an array of values separated by comma or specified via multiple flags. Each array item can contain comma inside single-quoted or double-quoted string, {}, [] and () braces. + -remoteWrite.basicAuth.usernameFile array + Optional path to basic auth username to use for the corresponding -remoteWrite.url. The file is re-read every second + Supports an array of values separated by comma or specified via multiple flags. + Each array item can contain comma inside single-quoted or double-quoted string, {}, [] and () braces. -remoteWrite.bearerToken array Optional bearer auth token to use for the corresponding -remoteWrite.url Supports an array of values separated by comma or specified via multiple flags. diff --git a/docs/victoriametrics/vmalert_common_flags.md b/docs/victoriametrics/vmalert_common_flags.md index 0e84a4f4ab..62a29de235 100644 --- a/docs/victoriametrics/vmalert_common_flags.md +++ b/docs/victoriametrics/vmalert_common_flags.md @@ -25,6 +25,8 @@ See the docs at https://docs.victoriametrics.com/victoriametrics/vmalert/ . Optional path to basic auth password to use for -datasource.url -datasource.basicAuth.username string Optional basic auth username for -datasource.url + -datasource.basicAuth.usernameFile string + Optional path to basic auth username to use for -datasource.url -datasource.bearerToken string Optional bearer auth token to use for -datasource.url. -datasource.bearerTokenFile string @@ -186,6 +188,10 @@ See the docs at https://docs.victoriametrics.com/victoriametrics/vmalert/ . Optional basic auth username for -notifier.url Supports an array of values separated by comma or specified via multiple flags. Each array item can contain comma inside single-quoted or double-quoted string, {}, [] and () braces. + -notifier.basicAuth.usernameFile array + Optional path to basic auth username file for -notifier.url + Supports an array of values separated by comma or specified via multiple flags. + Each array item can contain comma inside single-quoted or double-quoted string, {}, [] and () braces. -notifier.bearerToken array Optional bearer token for -notifier.url Supports an array of values separated by comma or specified via multiple flags. @@ -298,6 +304,8 @@ See the docs at https://docs.victoriametrics.com/victoriametrics/vmalert/ . Optional path to basic auth password to use for -remoteRead.url -remoteRead.basicAuth.username string Optional basic auth username for -remoteRead.url + -remoteRead.basicAuth.usernameFile string + Optional path to basic auth username to use for -remoteRead.url -remoteRead.bearerToken string Optional bearer auth token to use for -remoteRead.url. -remoteRead.bearerTokenFile string @@ -342,6 +350,8 @@ See the docs at https://docs.victoriametrics.com/victoriametrics/vmalert/ . Optional path to basic auth password to use for -remoteWrite.url -remoteWrite.basicAuth.username string Optional basic auth username for -remoteWrite.url + -remoteWrite.basicAuth.usernameFile string + Optional path to basic auth username to use for -remoteWrite.url -remoteWrite.bearerToken string Optional bearer auth token to use for -remoteWrite.url. -remoteWrite.bearerTokenFile string diff --git a/docs/victoriametrics/vmgateway.md b/docs/victoriametrics/vmgateway.md index 60d078ee91..2fde31bcdb 100644 --- a/docs/victoriametrics/vmgateway.md +++ b/docs/victoriametrics/vmgateway.md @@ -419,6 +419,8 @@ Below is the list of configuration flags (it can be viewed by running `./vmgatew Optional path to basic auth password to use for -datasource.url -datasource.basicAuth.username string Optional basic auth username for -datasource.url + -datasource.basicAuth.usernameFile string + Optional path to basic auth username to use for -datasource.url -datasource.bearerToken string Optional bearer auth token to use for -datasource.url. -datasource.bearerTokenFile string