-
Notifications
You must be signed in to change notification settings - Fork 3.5k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Backports #10958.
- Loading branch information
Showing
4 changed files
with
39 additions
and
27 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,23 +1,27 @@ | ||
--- | ||
title: Authentication | ||
description: Authentication | ||
weight: 10 | ||
menuTitle: | ||
description: Describes Loki's authentication. | ||
weight: | ||
--- | ||
# Authentication | ||
|
||
Grafana Loki does not come with any included authentication layer. Operators are | ||
expected to run an authenticating reverse proxy in front of your services. A helpful list of open-source reverse proxies to use: | ||
expected to run an authenticating reverse proxy in front of your services. | ||
|
||
The simple scalable [deployment mode]({{< relref "../get-started/deployment-modes" >}}) requires a reverse proxy to be deployed in front of Loki, to direct client API requests to either the read or write nodes. The Loki Helm chart includes a default reverse proxy configuration, using Nginx. | ||
|
||
A list of open-source reverse proxies you can use: | ||
|
||
- [Pomerium](https://www.pomerium.com/docs), which has a [guide for securing Grafana](https://www.pomerium.com/docs/guides/grafana) | ||
- [NGINX](https://docs.nginx.com/nginx/) using their [guide on restricting access with HTTP basic authentication](https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-http-basic-authentication/) | ||
- [OAuth2 proxy](https://github.com/oauth2-proxy/oauth2-proxy) | ||
- [HAProxy](https://www.haproxy.org/) | ||
|
||
|
||
Note that when using Loki in multi-tenant mode, Loki requires the HTTP header | ||
`X-Scope-OrgID` to be set to a string identifying the tenant; the responsibility | ||
of populating this value should be handled by the authenticating reverse proxy. | ||
Read the [multi-tenancy]({{< relref "./multi-tenancy" >}}) documentation for more information. | ||
For more inforamtion, read the [multi-tenancy]({{< relref "./multi-tenancy" >}}) documentation. | ||
|
||
For information on authenticating Promtail, please see the docs for [how to | ||
For information on authenticating Promtail, see the documentation for [how to | ||
configure Promtail]({{< relref "../send-data/promtail/configuration" >}}). |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters