Skip to content

vmauth: prevent from appending target_path_suffix multiple times #2104

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AndrewChubatiuk wants to merge 1 commit into
base: master
Choose a base branch
from
Open

vmauth: prevent from appending target_path_suffix multiple times #2104

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions docs/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ aliases:

* BUGFIX: [converter](https://docs.victoriametrics.com/operator/integrations/prometheus/#objects-conversion): disable all prometheus controllers if CRD group was not found. See [#2838](https://github.com/VictoriaMetrics/helm-charts/issues/2838).
* BUGFIX: [vmdistributed](https://docs.victoriametrics.com/operator/resources/vmdistributed/): change default load balancing policy for write requests from `first_available` to `least_loaded`. This should allow to evenly distribute write load across all VMAgents.
* BUGFIX: [vmauth](https://docs.victoriametrics.com/operator/resources/vmauth/): fixed case, when target_path_suffix can be appended multiple times.
Copy link
Copy Markdown
Contributor

@cubic-dev-ai cubic-dev-ai Bot Apr 25, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: Custom agent: Changelog Review Agent

New changelog entry is missing mandatory issue/PR references and does not meet the required user-centric before/now/improvement structure.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At docs/CHANGELOG.md, line 20:

<comment>New changelog entry is missing mandatory issue/PR references and does not meet the required user-centric before/now/improvement structure.</comment>

<file context>
@@ -17,6 +17,7 @@ aliases:
 
 * BUGFIX: [converter](https://docs.victoriametrics.com/operator/integrations/prometheus/#objects-conversion): disable all prometheus controllers if CRD group was not found. See [#2838](https://github.com/VictoriaMetrics/helm-charts/issues/2838).
 * BUGFIX: [vmdistributed](https://docs.victoriametrics.com/operator/resources/vmdistributed/): change default load balancing policy for write requests from `first_available` to `least_loaded`. This should allow to evenly distribute write load across all VMAgents.
+* BUGFIX: [vmauth](https://docs.victoriametrics.com/operator/resources/vmauth/): fixed case, when target_path_suffix can be appended multiple times.
 
 ## [v0.69.0](https://github.com/VictoriaMetrics/operator/releases/tag/v0.69.0)
</file context>
Fix with Cubic


## [v0.69.0](https://github.com/VictoriaMetrics/operator/releases/tag/v0.69.0)
**Release date:** 22 April 2026
Expand Down
2 changes: 1 addition & 1 deletion internal/controller/operator/factory/vmauth/vmusers_config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -654,7 +654,7 @@ func genURLMaps(userName string, refs []vmv1beta1.TargetRef, result yaml.MapSlic
case len(ref.Static.URL) > 0:
urlPrefixes = append(urlPrefixes, ref.Static.URL)
case len(ref.Static.URLs) > 0:
urlPrefixes = ref.Static.URLs
urlPrefixes = append(urlPrefixes, ref.Static.URLs...)
default:
return nil, fmt.Errorf("static.url, static.urls and ref.crd cannot be empty for user: %s", userName)
}
Expand Down
155 changes: 123 additions & 32 deletions internal/controller/operator/factory/vmauth/vmusers_config_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1001,24 +1001,69 @@ func Test_buildConfig(t *testing.T) {
SelectAllByDefault: true,
DefaultTargetRefs: []vmv1beta1.TargetRef{
{
Name: "vminsert",
Name: "write",
CRD: &vmv1beta1.CRDRef{
Kind: "VMCluster/vminsert",
Kind: "VMAgent",
NamespacedName: vmv1beta1.NamespacedName{
Name: "cluster",
Name: "cache",
Namespace: "monitoring",
},
},
Paths: []string{"/insert/.+", "/api/v1/write"},
URLMapCommon: vmv1beta1.URLMapCommon{
RetryStatusCodes: []int{500, 502, 503},
LoadBalancingPolicy: ptr.To("first_available"),
},
},
{
Name: "vmselect",
Name: "read",
CRD: &vmv1beta1.CRDRef{
Kind: "VMCluster/vmselect",
NamespacedName: vmv1beta1.NamespacedName{
Name: "cluster",
Namespace: "monitoring",
},
},
Paths: []string{"/select/.+", "/admin/tenants"},
URLMapCommon: vmv1beta1.URLMapCommon{
RetryStatusCodes: []int{500, 502, 503},
LoadBalancingPolicy: ptr.To("first_available"),
},
},
},
UnauthorizedUserAccessSpec: &vmv1beta1.VMAuthUnauthorizedUserAccessSpec{
TargetRefs: []vmv1beta1.TargetRef{
{
Name: "write",
URLMapCommon: vmv1beta1.URLMapCommon{
LoadBalancingPolicy: ptr.To("least_loaded"),
},
},
{
Name: "read",
URLMapCommon: vmv1beta1.URLMapCommon{
LoadBalancingPolicy: ptr.To("least_loaded"),
},
},
{
Static: &vmv1beta1.StaticRef{
URLs: []string{
"http://vmagent-cache-az-1:8429",
"http://vmagent-cache-az-2:8429",
},
},
TargetPathSuffix: "/insert/2",
Paths: []string{
"/vmagent",
"/vmagent/.*",
},
URLMapCommon: vmv1beta1.URLMapCommon{
RequestHeaders: []string{"baz: bar"},
RetryStatusCodes: []int{500, 502, 503},
LoadBalancingPolicy: ptr.To("least_loaded"),
DropSrcPathPrefixParts: ptr.To(1),
},
},
},
},
},
Expand All @@ -1034,6 +1079,12 @@ func Test_buildConfig(t *testing.T) {
VMInsert: &vmv1beta1.VMInsert{},
},
},
&vmv1beta1.VMAgent{
ObjectMeta: metav1.ObjectMeta{
Name: "cache",
Namespace: "monitoring",
},
},
&vmv1beta1.VMUser{
ObjectMeta: metav1.ObjectMeta{
Name: "user-1",
Expand All @@ -1044,56 +1095,96 @@ func Test_buildConfig(t *testing.T) {
BearerToken: ptr.To("secret-token"),
TargetRefs: []vmv1beta1.TargetRef{
{
Name: "vminsert",
Name: "write",
TargetPathSuffix: "/insert/1",
},
{
Name: "vmselect",
Name: "read",
TargetPathSuffix: "/select/1",
},
{
CRD: &vmv1beta1.CRDRef{
Kind: "VMCluster/vminsert",
NamespacedName: vmv1beta1.NamespacedName{
Name: "cluster",
Namespace: "monitoring",
},
},
TargetPathSuffix: "/insert/2",
},
},
},
},
},
want: `users:
- url_map:
- url_prefix:
- http://vminsert-cluster.monitoring.svc:8480/insert/1
- http://vmagent-cache.monitoring.svc:8429/insert/1
src_paths:
- /insert/.+
- /api/v1/write
retry_status_codes:
- 500
- 502
- 503
load_balancing_policy: first_available
- url_prefix:
- http://vmselect-cluster.monitoring.svc:8481/select/1
src_paths:
- /select/.+
- /admin/tenants
retry_status_codes:
- 500
- 502
- 503
load_balancing_policy: first_available
- url_prefix:
- http://vminsert-cluster.monitoring.svc:8480/insert/2
src_paths:
- /newrelic/.*
- /opentelemetry/.*
- /prometheus/api/v1/write
- /prometheus/api/v1/import.*
- /influx/.*
- /datadog/.*
name: user1
bearer_token: secret-token
unauthorized_user:
url_map:
- url_prefix:
- http://vmselect-cluster.monitoring.svc:8481/select/1
- http://vmagent-cache.monitoring.svc:8429
src_paths:
- /insert/.+
- /api/v1/write
retry_status_codes:
- 500
- 502
- 503
load_balancing_policy: least_loaded
- url_prefix:
- http://vmselect-cluster.monitoring.svc:8481
src_paths:
- /vmui.*
- /vmui.*
- /graph.*
- /prometheus/graph.*
- /prometheus/vmui.*
- /prometheus/api/v1/label.*
- /prometheus/api/v1/query.*
- /prometheus/api/v1/rules
- /prometheus/api/v1/alerts
- /prometheus/api/v1/metadata
- /prometheus/api/v1/series.*
- /prometheus/api/v1/status.*
- /prometheus/api/v1/export.*
- /prometheus/federate
- /select/.+
- /admin/tenants
- /api/v1/status/.*
- /api/v1/rules
- /internal/resetRollupResultCache
- /prometheus/api/v1/admin/.*
- /prometheus.*-debug
- /prometheus/prettify-query
- /prometheus/api/v1/notifiers
- /prometheus/api/v1/query_exemplars
name: user1
bearer_token: secret-token
retry_status_codes:
- 500
- 502
- 503
load_balancing_policy: least_loaded
- url_prefix:
- http://vmagent-cache-az-1:8429/insert/2
- http://vmagent-cache-az-2:8429/insert/2
src_paths:
- /vmagent
- /vmagent/.*
headers:
- 'baz: bar'
retry_status_codes:
- 500
- 502
- 503
drop_src_path_prefix_parts: 1
load_balancing_policy: least_loaded
`,
})

Expand Down
Loading