prometheus / prometheus/alertmanager
Feature request: restrict the identity of silence creator to one passed by some HTTP header
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 8.6k
- Forks
- 2.5k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 61
Description
What did you do?
We configure a proxy in front of Alert Manager to authenticate, authorize and audit access, especially with regard to creating silences.
Currently a user can still enter any value they like for the "Creator" field of a silence through the web UI.
What did you expect to see?
It would be super if we could have an option to force the Creator value to one set via some HTTP header that is inserted into the request by the authenticating proxy. For example, if the proxy set the X-Alertmanager-User header, then the Alertmanager UI application would prepopulate the field and only permit values for "Creator" that matched that header value.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how the web UI submits the silence Creator field and how the Alertmanager backend handles that request when it comes through an authenticating proxy. Verify how the proposed HTTP header should be trusted, handled when absent, and applied to both UI and API requests. Done means the Creator cannot differ from the accepted header value and tests cover the enforced behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication, backend, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100