Skip to content

feat(runner/prometheus): PROMETHEUS_AUTH, URL query string, retention fallback - #526

Open
mayankpande88 wants to merge 3 commits into
mainfrom
fix/runner-prometheus-auth-querystring
Open

feat(runner/prometheus): PROMETHEUS_AUTH, URL query string, retention fallback#526
mayankpande88 wants to merge 3 commits into
mainfrom
fix/runner-prometheus-auth-querystring

Conversation

@mayankpande88

Copy link
Copy Markdown
Contributor

Restore three prometheus config knobs the legacy agent honored:

  • PROMETHEUS_AUTH: a static Authorization header applied to every
    Prometheus request (direct client + UI proxy path). Overlaid via Set
    so it takes precedence over any Authorization in PROMETHEUS_HEADERS.
  • PROMETHEUS_URL_QUERY_STRING: appended to the query string of every
    Prometheus request (direct client + proxy), preserving existing params.
  • PROMETHEUS_RETENTION_TIME: fallback retention value reported to the UI
    when /status/flags is unavailable (VictoriaMetrics vmsingle 404s it);
    also read VM's -retentionPeriod flag key when present.

Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01L2HAXQH1gEtX7h4sUJsi9j

@mayankpande88
mayankpande88 requested a review from a team as a code owner July 14, 2026 19:28

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces support for several new Prometheus configuration variables, including PROMETHEUS_AUTH for static authorization, PROMETHEUS_URL_QUERY_STRING to append query parameters to Prometheus requests, and PROMETHEUS_RETENTION_TIME as a fallback retention value. It updates the agent runner, Prometheus client, and Grafana proxy to handle these configurations, and extends the retention probe to support VictoriaMetrics. Feedback on the changes points out discrepancies in the documentation and code comments regarding the delimiter for PROMETHEUS_HEADERS (which is parsed as comma-separated, not semicolon-separated), and suggests using net/url instead of manual string manipulation to safely append query parameters.

|---|---|---|
| `PROMETHEUS_URL` | recommended | Enables `prometheus_*` actions and `service_map` |
| `PROMETHEUS_HEADERS` | optional | Comma-separated `Header: value` pairs (e.g. `X-Scope-OrgID: tenant-1`); use for static basic/bearer auth |
| `PROMETHEUS_HEADERS` | optional | Semicolon-separated `Header: value` pairs (e.g. `X-Scope-OrgID: tenant-1`); use for static basic/bearer auth |

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The documentation states that PROMETHEUS_HEADERS is semicolon-separated, but the underlying parser config.ParseHeaders in runner/pkg/config/config.go splits headers by commas (,):

for _, part := range strings.Split(s, ",")

If users configure this variable using semicolons, it will fail to parse correctly (e.g., the second header will be treated as part of the first header's value). Please revert this to 'Comma-separated' or update the parser to support semicolons.


// PrometheusHeaders is the parsed PROMETHEUS_HEADERS env (raw
// "Header: value, Header: value" string) — applied to every
// "Header: value; Header: value" string) — applied to every

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

This comment describes PROMETHEUS_HEADERS as semicolon-separated (Header: value; Header: value), but config.ParseHeaders actually parses them using commas (,) as delimiters. Please update the comment to reflect the actual comma-separated format to avoid confusion.

Suggested change
// "Header: value; Header: value" string) — applied to every
// "Header: value, Header: value" string) — applied to every

Comment on lines +182 to +193
func appendQueryString(rawurl, extra string) string {
extra = strings.TrimSpace(extra)
extra = strings.TrimPrefix(extra, "?")
if extra == "" {
return rawurl
}
sep := "?"
if strings.Contains(rawurl, "?") {
sep = "&"
}
return rawurl + sep + extra
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Using manual string manipulation to append query parameters can be fragile (e.g., if the URL already ends with ? or &, or contains fragments). Since net/url is already imported in this file, we can leverage url.Parse to safely and robustly append the query string.

func appendQueryString(rawurl, extra string) string {
	extra = strings.TrimSpace(extra)
	extra = strings.TrimPrefix(extra, "?")
	if extra == "" {
		return rawurl
	}
	u, err := url.Parse(rawurl)
	if err != nil {
		sep := "?"
		if strings.Contains(rawurl, "?") {
			sep = "&"
		}
		return rawurl + sep + extra
	}
	if u.RawQuery == "" {
		u.RawQuery = extra
	} else {
		u.RawQuery += "&" + extra
	}
	return u.String()
}

RamanKharchee
RamanKharchee previously approved these changes Jul 15, 2026
claude and others added 2 commits September 3, 2026 10:20
… fallback

Restore three prometheus config knobs the legacy agent honored:

- PROMETHEUS_AUTH: a static Authorization header applied to every
  Prometheus request (direct client + UI proxy path). Overlaid via Set
  so it takes precedence over any Authorization in PROMETHEUS_HEADERS.
- PROMETHEUS_URL_QUERY_STRING: appended to the query string of every
  Prometheus request (direct client + proxy), preserving existing params.
- PROMETHEUS_RETENTION_TIME: fallback retention value reported to the UI
  when /status/flags is unavailable (VictoriaMetrics vmsingle 404s it);
  also read VM's -retentionPeriod flag key when present.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L2HAXQH1gEtX7h4sUJsi9j
(cherry picked from commit b3a55fe)
…cedence

promHeadersWithAuth had been inserted between esHTTPClient's doc comment and
its declaration, so the comment described the wrong function. Also records
that falling back to PROMETHEUS_RETENTION_TIME on a successful flags response
that lacks both retention keys is an intentional extension of the legacy
behavior, not an accident.
@mayankpande88
mayankpande88 force-pushed the fix/runner-prometheus-auth-querystring branch from 4ee4b88 to 8bc63a9 Compare September 3, 2026 04:53
@mayankpande88

Copy link
Copy Markdown
Contributor Author

Rebased onto main. Verified against the legacy agent: prometheus_auth, prometheus_url_query_string (including the leading-? strip), PROMETHEUS_RETENTION_TIME, and the storage.tsdb.retention.time / -retentionPeriod key pair all match base_params.py and prometheus/utils.py.

Two fixes while rebasing:

  • promHeadersWithAuth had been inserted between esHTTPClient's doc comment and its declaration, so the comment documented the wrong function. Moved.
  • Recorded that the retention fallback is an intentional extension: legacy applies PROMETHEUS_RETENTION_TIME only when the flags call fails outright, whereas this also falls back when the call succeeds but carries neither retention key. Better behavior, but it should be a deliberate choice rather than an accident.

Note this will conflict with #523 on runner/docs/configuration.md (both edit the PROMETHEUS_HEADERS row) — whichever merges second needs a one-line rebase.

@github-actions

github-actions Bot commented Sep 3, 2026

Copy link
Copy Markdown
Contributor

📦 Image Tags Updated

I've automatically updated the image tags in `charts/nudgebee-agent/values.yaml` to the latest versions from GHCR for the `main` branch.

The image tags are now synchronized with the latest builds and ready for release.

1 similar comment
@github-actions

github-actions Bot commented Sep 3, 2026

Copy link
Copy Markdown
Contributor

📦 Image Tags Updated

I've automatically updated the image tags in `charts/nudgebee-agent/values.yaml` to the latest versions from GHCR for the `main` branch.

The image tags are now synchronized with the latest builds and ready for release.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants