Documentation of OrgID

[base698]

Describe the bug
Documentation in https://github.com/grafana/loki/blob/master/docs/operations.md mentions an OrgID but the config examples have no mention of org id only s3 credentials. Where do you put the orgid?

Loki is using S3 as object storage. It stores log within directories based on OrgID. For example, Logs from org faker will stored in s3://BUCKET_NAME/faker/.

Expected behavior
Documentation which is consistent.

[base698]

What is multitenancy mode?

$ ./loki --help 2>&1 | grep tenan

Nothing returns, don't appear to be an flags documentated.

[daixiang0]

ping @yubozhao

[base698]

It works if I do auth_enabled: false. Not sure where the org Id is supposed to come from if it's used.

[yubozhao]

It is not a bug

Loki is designed with multi tenant in mind. If you are using Loki for internal use, you can turn off multi tenant support with auth_enabled to false.

If you want to use the multi tenant support. There are 2 ways to do that.

1. Fork your own promtail and pass orgID in your header
2. Have a nginx server in front of Loki and mutate the header by adding orgID

[yubozhao]

It is documented at operation.md

Authentication
Loki does not have an authentication layer. You are expected to run an authenticating reverse proxy in front of your services, such as an Nginx with basic auth or an OAuth2 proxy.

Multi-tenancy
Loki is a multitenant system; requests and data for tenant A are isolated from tenant B. Requests to the Loki API should include an HTTP header (X-Scope-OrgID) identifying the tenant for the request. Tenant IDs can be any alphanumeric string; limiting them to 20 bytes is reasonable. To run in multitenant mode, loki should be started with auth_enabled: true.

Loki can be run in "single-tenant" mode where the X-Scope-OrgID header is not required. In this situation, the tenant ID is defaulted to be fake.

[base698]

But how do you set the header in promtail? Promtail makes the request to the API and I don't see anything in the config there about the OrdID.

…

On Mon, Apr 29, 2019, 7:46 PM Bozhao ***@***.***> wrote: It is documented at operation.md Authentication Loki does not have an authentication layer. You are expected to run an authenticating reverse proxy in front of your services, such as an Nginx with basic auth or an OAuth2 proxy. Multi-tenancy Loki is a multitenant system; requests and data for tenant A are isolated from tenant B. Requests to the Loki API should include an HTTP header (X-Scope-OrgID) identifying the tenant for the request. Tenant IDs can be any alphanumeric string; limiting them to 20 bytes is reasonable. To run in multitenant mode, loki should be started with auth_enabled: true. Loki can be run in "single-tenant" mode where the X-Scope-OrgID header is not required. In this situation, the tenant ID is defaulted to be fake. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#525 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AABSVGUBAXUCM5IP4FXO23LPS6XHRANCNFSM4HI7BVLQ> .

[base698]

Also, if Loki doesn't have an authentication layer then why is there an auth_enabled false setting? On Mon, Apr 29, 2019, 7:49 PM Justin Thomas <justin.thomas1@gmail.com> wrote:

…

But how do you set the header in promtail? Promtail makes the request to the API and I don't see anything in the config there about the OrdID. On Mon, Apr 29, 2019, 7:46 PM Bozhao ***@***.***> wrote: > It is documented at operation.md > > Authentication > Loki does not have an authentication layer. You are expected to run an > authenticating reverse proxy in front of your services, such as an Nginx > with basic auth or an OAuth2 proxy. > > Multi-tenancy > Loki is a multitenant system; requests and data for tenant A are isolated > from tenant B. Requests to the Loki API should include an HTTP header > (X-Scope-OrgID) identifying the tenant for the request. Tenant IDs can be > any alphanumeric string; limiting them to 20 bytes is reasonable. To run in > multitenant mode, loki should be started with auth_enabled: true. > > Loki can be run in "single-tenant" mode where the X-Scope-OrgID header is > not required. In this situation, the tenant ID is defaulted to be fake. > > — > You are receiving this because you authored the thread. > Reply to this email directly, view it on GitHub > <#525 (comment)>, or mute > the thread > <https://github.com/notifications/unsubscribe-auth/AABSVGUBAXUCM5IP4FXO23LPS6XHRANCNFSM4HI7BVLQ> > . >

[cyriltovena]

Usually authentification system are specific to companies, so if you want to run in multi tenant you should write/use a proxy that will authenticate request and forward the correct X-Scope-OrgID to Loki.

auth_enabled deactivates the need to send the X-Scope-OrgID, in fact it use a single dummy one.

[slim-bean]

I don't see why support couldn't be added to promtail to specify an OrgID via config which then adds the X-Scope-OrgID header? I don't see any harm in doing this?

[yubozhao]

I was going to do that @slim-bean. Then other things took priority

[DeepLJH0001]

I had resolve this problem，using the nginx-ingress annotation,so it can work well in muti-cluster scene.
the request path may like : muti-cluster->muti-promtail->specific ingress in the cluster which was set to manager-plane and has deploy loki ->loki received

an example ingress for you

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: cluster-name-loki
  namespace: loki
  labels:
    app: loki
    chart: loki-0.13.0
    release: release-name
    heritage: Tiller
  annotations:
    nginx.ingress.kubernetes.io/configuration-snippet: |
      more_set_headers "X-Scope-OrgID: cluster-name";
    nginx.ingress.kubernetes.io/rewrite-target: /
    nginx.ingress.kubernetes.io/ssl-redirect: "false" 
spec:
  rules:
  - http:
      paths:
      - backend:
          serviceName: loki-servicename
          servicePort: 3100
        path: /cluster-name/loki/*

if your loki was runing in https, please ignore this nginx.ingress.kubernetes.io/ssl-redirect: "false" . may be this demo can add to the documentation if anyone want to set muti-cluster with single loki :)

[stale]

This issue has been automatically marked as stale because it has not had any activity in the past 30 days. It will be closed in 7 days if no further activity occurs. Thank you for your contributions.

[chiqui3d]

I don't understand if Loki doesn't have any kind of OrgID option, then the validation has to be done by us?

Also, I have also added Loki to Nginx as a proxy to do a basic password validation, the problem now that the Docker Driver plugin for Loggging does not have any option to send the user and password, or does it?

So right now, I can't find any way to secure the Loki API

Edit: I finally found the solution with internal network here #1368 (comment)