401 Authorization Required when send logs from Fluentbit to Loki gateway with ingress and basic-auth #8721

Angel0r · 2024-04-16T12:19:00Z

Angel0r
Apr 16, 2024

Hello,

I am using the grafana/loki Helm Chart. Since it is going to be in production I am trying to use Loki gateway ingress with and basic-auth. When I enable ingress and basic auth I get the following error:

[2024/04/16 11:40:03] [error] [output:loki:loki.0] loki-gateway.com:443, HTTP status=401
<html>
<head><title>401 Authorization Required</title></head>
<body>
<center><h1>401 Authorization Required</h1></center>
<hr><center>nginx/1.24.0</center>
</body>
</html>

My configuration looks like below:
Loki:

    gateway:
      enabled: true
      replicas: 1
      verboseLogging: true
      ingress:
        enabled: true
        ingressClassName: "nginx"
        annotations: 
          nginx.ingress.kubernetes.io/auth-secret: loki-gateway-tls
          nginx.ingress.kubernetes.io/auth-type: basic
        labels: {}
        hosts:
          - host: loki-gateway.com
            paths:
              - path: /
                pathType: Prefix
        tls:
          - secretName: loki-gateway-tls
            hosts:
              - loki-gateway.com

Secret(loki-gateway-tls):

apiVersion: v1
data:
  auth: dXNlcm5hbWU6JDJ5JDA1JGdvbWR2cUtkQjd4U0UxNFp5ZllhYWVjOE1tWk5WSGFBblRkcnRpcVp4MkpFVG9pY1RlSmlX
kind: Secret
metadata:
  annotations:
    sealedsecrets.bitnami.com/namespace-wide: "true"
  creationTimestamp: "2024-04-15T07:04:25Z"
  name: loki-gateway-tls
  namespace: logs-and-monitoring
  ownerReferences:
  - apiVersion: bitnami.com/v1alpha1
    controller: true
    kind: SealedSecret
    name: loki-gateway-tls
type: Opaque

Fluentbit:

        [OUTPUT]
            Name                   loki
            Match                  *
            Host                   loki-gateway.com
            Port                   443
            Http_User              username
            Http_Passwd            password
            TLS                    On
            tls.verify             On
            Labels                 job=fluentbit
            Auto_Kubernetes_Labels on
            Compress               gzip

I tested the ingress with username and password and it works fine:

curl -v -u username:password https://loki-gateway.com:443

What am I missing?

/Angelos

agup006 · 2024-04-17T20:45:22Z

agup006
Apr 17, 2024
Maintainer

Does that user have permissions to write to loki?

1 reply

Angel0r Apr 18, 2024
Author

Hello @agup006,

Hmm. I am running this in Kubernetes and I just created an htpasswd for the basicauth. Do I need to assign roles and create rolesbindings?

Angel0r · 2024-04-18T11:38:14Z

Angel0r
Apr 18, 2024
Author

In Loki values, if I disable gateway and enable ingress and then use tls/basicauth there it works fine.
https://github.com/grafana/loki/blob/main/production/helm/loki/values.yaml#L1136

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

401 Authorization Required when send logs from Fluentbit to Loki gateway with ingress and basic-auth #8721

Uh oh!

{{title}}

Uh oh!

Replies: 2 comments 1 reply

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

401 Authorization Required when send logs from Fluentbit to Loki gateway with ingress and basic-auth #8721

Uh oh!

Angel0r Apr 16, 2024

Replies: 2 comments · 1 reply

Uh oh!

agup006 Apr 17, 2024 Maintainer

Uh oh!

Angel0r Apr 18, 2024 Author

Uh oh!

Angel0r Apr 18, 2024 Author

Angel0r
Apr 16, 2024

Replies: 2 comments 1 reply

agup006
Apr 17, 2024
Maintainer

Angel0r Apr 18, 2024
Author

Angel0r
Apr 18, 2024
Author