{"id":27643754,"url":"https://github.com/ikethecoder/prom-multi-tenant-proxy","last_synced_at":"2025-04-24T00:17:49.228Z","repository":{"id":143893215,"uuid":"294543887","full_name":"ikethecoder/prom-multi-tenant-proxy","owner":"ikethecoder","description":"Prometheus Multi-Tenant Proxy for securing metrics","archived":false,"fork":false,"pushed_at":"2025-02-19T06:59:50.000Z","size":11819,"stargazers_count":1,"open_issues_count":0,"forks_count":2,"subscribers_count":1,"default_branch":"dev","last_synced_at":"2025-04-24T00:17:30.865Z","etag":null,"topics":["kong","metrics","multi-tenant","prometheus"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ikethecoder.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-09-10T23:19:50.000Z","updated_at":"2025-02-19T06:59:53.000Z","dependencies_parsed_at":null,"dependency_job_id":"b928a882-829f-4dca-b915-355c58d6606d","html_url":"https://github.com/ikethecoder/prom-multi-tenant-proxy","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ikethecoder%2Fprom-multi-tenant-proxy","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ikethecoder%2Fprom-multi-tenant-proxy/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ikethecoder%2Fprom-multi-tenant-proxy/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ikethecoder%2Fprom-multi-tenant-proxy/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ikethecoder","download_url":"https://codeload.github.com/ikethecoder/prom-multi-tenant-proxy/tar.gz/refs/heads/dev","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":250535104,"owners_count":21446510,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["kong","metrics","multi-tenant","prometheus"],"created_at":"2025-04-24T00:17:48.677Z","updated_at":"2025-04-24T00:17:49.211Z","avatar_url":"https://github.com/ikethecoder.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Prometheus Multi-Tenant Proxy\n\nTwo micro-services:\n\n1. Sits between the metrics provider and Prometheus, enriching the metrics with a configurable `namespace`.\n2. Sits between Prometheus and Grafana to inject the `namespace` into the query based on a claim in a JWT token.\n\nExample:\n\nKong --\u003e `metrics-proxy` --\u003e Prometheus \u003c-- `query-proxy` \u003c-- Grafana \u003c-- Keycloak\n\n## Building\n\n```\ncd metrics-proxy\nmake go-build\nbin/metrics-proxy\n\ncd query-proxy\nmake go-build\nbin/query-proxy\n```\n\n## Running\n\n### Metrics Proxy\n\n```\nexport MYAPP_PORT=9092\nexport MYAPP_METRICSURL=https://kong-admin:8001\nexport MYAPP_KONGURL=https://kong-admin:8001\n\nbin/metrics-proxy\n```\n\n### Query Proxy\n\n```\nexport MYAPP_PORT=9091\nexport MYAPP_PROMETHEUSURL=http://prometheus-server:9090\nexport MYAPP_NAMESPACELABEL=team\nexport MYAPP_NAMESPACECLAIM=team\nexport MYAPP_JWKSURL=https://auth.org/auth/realms/myrealm/protocol/openid-connect/certs\nexport MYAPP_VERIFYTOKEN=false\n\nbin/query-proxy\n```\n\n```\nexport TOK=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJleHAiOjE5MTYyMzkwMjIsInRlYW0iOiJhYmMifQ.bdmbECR2RdUCRxgSpY8hxQ0aRYlKyvHZxRfoinLUeA0\n\nexport QUERY=\"sum(rate(kong_http_status%7Binstance%3D~%22.*%22%7D%5B1m%5D))\"\n\ncurl -v \"http://localhost:9092/api/v1/query_range?step=14\u0026time=1626378465.306\u0026query=$QUERY\" -H \"Authorization: Bearer $UTOK\"\n\n```\n\n## Docker\n\n### Metrics Proxy\n\n```\ndocker build --tag metrics-proxy.local -f metrics-proxy/Dockerfile metrics-proxy\n\ndocker run --rm --name metrics-proxy \\\n  -p 9091:9091 \\\n  -e MYAPP_PORT=9091 \\\n  -e MYAPP_METRICSURL=https://metrics_providers/metrics \\\n  -e MYAPP_KONGURL=https://kong:8001/metrics \\\n  metrics-proxy.local\n```\n\n### Query Proxy\n\n```\ndocker build --tag query-proxy.local -f query-proxy/Dockerfile query-proxy\n\ndocker run --rm --name query-proxy \\\n  -p 9092:9092 \\\n  -e MYAPP_PORT=9092 \\\n  -e MYAPP_NAMESPACELABEL=namespace \\\n  -e MYAPP_NAMESPACECLAIM=team \\\n  -e MYAPP_PROMETHEUSURL=http://prometheus-server:9090 \\\n  -e MYAPP_JWKSURL=https://auth.org/auth/realms/myrealm/protocol/openid-connect/certs \\\n  -e MYAPP_RESOURCESERVERURL=https://res_server_url \\\n  query-proxy.local\n\n\nexport QUERY=\"sum(kong_http_status)%20by%20(namespace)\"\ncurl -v \"http://localhost:9092/api/v1/query?_=1626378295929\u0026time=1626378465.306\u0026query=$QUERY\" -H \"Authorization: Bearer $UTOK\"\n\n# Pick one of the namespaces\nexport QUERY=\"sum(kong_http_status%7Bnamespace%3D~%27apsperf%27%7D)%20by%20(namespace)\"\ncurl -v \"http://localhost:9092/api/v1/query?_=1626378295929\u0026time=1626378465.306\u0026query=$QUERY\" -H \"Authorization: Bearer $UTOK\"\n\n# Pick all except one namespace\nexport QUERY='sum(kong_http_status%7Bnamespace!~%27apsperf%27%7D)%20by%20(namespace)'\ncurl -v \"http://localhost:9092/api/v1/query?_=1626378295929\u0026time=1626378465.306\u0026query=$QUERY\" -H \"Authorization: Bearer $UTOK\"\n\n# Pick a namespace that the user is not apart of\nexport QUERY=\"sum(kong_http_status%7Bnamespace%3D~%27erx-demo%27%7D)%20by%20(namespace)\"\ncurl -v \"http://localhost:9092/api/v1/query?_=1626378295929\u0026time=1626378465.306\u0026query=$QUERY\" -H \"Authorization: Bearer $UTOK\"\n\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fikethecoder%2Fprom-multi-tenant-proxy","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fikethecoder%2Fprom-multi-tenant-proxy","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fikethecoder%2Fprom-multi-tenant-proxy/lists"}