feat(auth): support basic auth #60
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
In PrefectHQ/prefect#16408, Prefect server added support for basic auth. This adds support for setting PREFECT_API_AUTH_STRING. The exporter will base64 encode this value and apply the value as a Basic auth header. Closes #59 Closes https://linear.app/prefect/issue/PLA-931/prometheus-prefect-exporter-doesnt-support-basic-authentication-when
mitchnielsen
commented
Jan 17, 2025
Comment on lines
+37
to
+39
| if api_auth_string: | ||
| api_auth_string_encoded = base64.b64encode(api_auth_string.encode("utf-8")).decode("utf-8") | ||
| headers["Authorization"] = f"Basic {api_auth_string_encoded}" |
There was a problem hiding this comment.
This matches the encoding approach upstream: https://github.com/PrefectHQ/prefect/pull/16408/files#diff-a52d8326344d84ccd617e704df9a030fd4a813a8d705510f778538423e7cf21dR307-R310
mitchnielsen
commented
Jan 17, 2025
| @@ -92,6 +92,7 @@ You can now reach each service locally: | |||
| You can modify environment variables to change the behavior of the exporter. | |||
| - An API Key is only required for auth-enabled, on-prem, self-managed solutions. | |||
| - An API key is not required for open-source or Prefect Server. | |||
| - If an API key and API auth string are provided, then the API key takes precedence. | |||
There was a problem hiding this comment.
I was reading up on this and if there was some scenario that would require both to be passed, you can supposedly supply one "Authorization" header key with a comma-separated list of values and that should work.
|
If this doesn't merge before I'm out next week, Platform/anyone can feel free to take this over - otherwise I'll pick it up again when I'm back on Jan 28. |
jamiezieziula
approved these changes
Jan 17, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
In PrefectHQ/prefect#16408, Prefect server added support for basic auth.
This adds support for setting PREFECT_API_AUTH_STRING. The exporter will base64 encode this value and apply the value as a Basic auth header.
Closes #59
Closes https://linear.app/prefect/issue/PLA-931/prometheus-prefect-exporter-doesnt-support-basic-authentication-when
Testing
Supply the authorization setting to the server and the client (exporter in this case):
Then run
docker compose up -d. This should build the exporter image, but if you need to refresh that image, rundocker compose build.Check the logs with
docker compose logs -f. You should see successful requests to the endpoints:And if you run some test flows, you should see metrics update at
http://localhost:8000.If you want to confirm auth is active, you can go to
http://localhost:4200and you should see an authorization window asking for the password before you can reach the UI.