Question: Usage of Loki Tenant Labels

[thikoen]

Dear @Lucostus You have a really cool project here. I would like to test the multena proxy inside one of our OpenShift clusters and have deployed an IDP, some example apps, ofc Grafana and Multena.
I now have a question regarding the tenant labels - maybe i missunderstood these.

My understanding:
I can define a label name inside the helm values, after that i can define the label value in e.g. the mentioned configmap.
Example: My app produces logs for loki with this label: namespace=abc, then i would set proxy.loki.tenantLabel = namespace and in my configmap i would set labels.userxyz.abc = true.

Is that correct? Since i am only able to view logs with the admin bypass enabled - with the setup ive described it just gives the error "no tenant label defined".

Would be great if you could answer my question.

Thanks a lot!!

[Lucostus]

Hey @thikoen thanks for your interest! From what I've read your understanding is correct. As a side note, the admin-bypass can be disabled.

[thikoen]

Hi @Lucostus wow, thanks for the fast answer! I managed to get it running using the username (tried the mail and a group before which did not work) which is pretty cool but actually the group would be great :D
When enabling trace logs of multena i can see:

{"level":"trace","group":"OCP-USER","time":1744219796,"message":"Group"}
-> Using this exact group in the labels ConfigMap does not work but setting the user directly works. Do you have a hint for me?

[Lucostus]

Do you refer to the groups or user labels in your config? As far as I remember it's not just "labels"

[thikoen]

So my example CM would look like

data:
  labels: |
    my-user-abc:
      namespace-xyz: true #works (user name)
    OCP-USER:
      namespace-xyz: true #does not work (group name)

I thought i can use a user and a group in the same way

[Lucostus]

yea yea my bad, looked it up it's in the same config. Actually: Did you set the oauth_group_name? That's the only thing I can think of right now.

[thikoen]

Hmm strange, i did set it to "groups" which is an array of single groups. Works at least in Grafana, for testing i mapped a Grafana role into (groups[*], OCP-USER) and that works.

[Lucostus]

Hey did you resolve the problem?

[jplitza]

I guess you ran into the same problem I did: #136