Bug: mimirtool remote read doesn't allow basic auth like other command #11435

pierremahot · 2025-05-06T16:05:10Z

pierremahot
May 6, 2025

What is the bug?

the mimirtool remote read doesn't allow basic auth like other command.
It use the tenant name has the basic auth user.

How to reproduce it?

export MIMIR_TENANT_ID=mimir-xxx
export MIMIR_ADDRESS=http://localhost:8080
export MIMIR_API_USER=mimir
export MIMIR_API_KEY=XXX

./mimirtool remote-read export --selector '{__name__="xxx"}' --tsdb-path ./local-test/xxx --read-timeout=50s --from="2025-05-01T12:00:00+02:00" --to="2025-05-01T13:00:00+02:00"
INFO[0000] Created remote read client using endpoint 'https://mimir.observability.filigran.io/prometheus/api/v1/read' 
INFO[0000] Using existing TSDB in path './local-test/xxx' 
INFO[0000] Querying time from=2025-05-01T12:00:00+02:00 to=2025-05-01T13:00:00+02:00 with selector={__name__="xxx"} 
main: error: remote server https://mimir.observability.filigran.io/prometheus/api/v1/read returned http status 401 Unauthorized: <html>
<head><title>401 Authorization Required</title></head>
<body>
<center><h1>401 Authorization Required</h1></center>
<hr><center>nginx/1.27.3</center>
</body>
</html>
, try --help
exit status 1

What did you think would happen?

use the user for basic auth no the tenant

What was your environment?

mimirtool 2.16.0
mimir-distributed-5.7.0
mimir 2.16.0

Any additional context to share?

using basic auth from the mirmir helm distributed chart

pracucci · 2025-05-11T06:37:53Z

pracucci
May 11, 2025
Maintainer

The mimirtool remote-read export tool doesn't support MIMIR_API_USER but `MIMIR_TENANT_ID´ instead. See its help:

--id=""                     Grafana Mimir tenant ID. Used for basic auth and as X-Scope-OrgID HTTP
                              header. Alternatively, set MIMIR_TENANT_ID. ($MIMIR_TENANT_ID)
  --key=""                    Basic auth password to use when contacting Grafana Mimir; alternatively,
                              set MIMIR_API_KEY. ($MIMIR_API_KEY)

I converted this issue to a discussion cause I don't think that's a bug.

1 reply

pierremahot May 12, 2025
Author

Hi i don't understand why having a different comportment only for remote-read command.
the mimirtool global parameters https://grafana.com/docs/mimir/latest/manage/tools/mimirtool/#configuration-options are not apply to this command.

this brake exporting multitenant instances that doesn't have the tenant id equal to the basic auth user.
All other command have the user parameter to set user when basic auth user it's not equal to the tenant name.
This is the behavior with the mimir helm distributed with basic auth and multitenancy.

maybe it's a feature but look miss leading using the tool to have difference on auth part depending on the command used (look's more like a bug using it).
I hope the PR #11402 will not be reject.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bug: mimirtool remote read doesn't allow basic auth like other command #11435

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 1 comment 1 reply

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Bug: mimirtool remote read doesn't allow basic auth like other command #11435

Uh oh!

Uh oh!

pierremahot May 6, 2025

What is the bug?

How to reproduce it?

What did you think would happen?

What was your environment?

Any additional context to share?

Replies: 1 comment · 1 reply

Uh oh!

pracucci May 11, 2025 Maintainer

Uh oh!

pierremahot May 12, 2025 Author

pierremahot
May 6, 2025

Replies: 1 comment 1 reply

pracucci
May 11, 2025
Maintainer

pierremahot May 12, 2025
Author