PoC: Metrics Access Control

[david-martin]

Use Case

As a platform administrator, I want to allow Team A to access only the metrics and views for their own APIs/HTTPRoutes.

• Enables secure App/API Developer dashboards and visualizations
• Will likely be a component that encompasses/manages the kube-rbac-proxy and prom-label-proxy components. It would be configured with the location of metrics & permissions to read all metrics.

Tools:

• Kube-rbac-proxy - Authenticates requests and enforces Kubernetes RBAC - https://github.com/brancz/kube-rbac-proxy
• Prom-label-proxy - Enforces label-based filtering on Prometheus queries - https://github.com/prometheus-community/prom-label-proxy

Approach:

• kube-rbac-proxy in front of Thanos Query to handle authentication and authorization
  prom-label-proxy between kube-rbac-proxy and Thanos to enforce label-based access control
• Add namespace labels to metrics emitted by shared components (Istio Gateway, Kuadrant) to identify the originating namespace.
• In istio metrics, this would be the destination_service_namepsace label on istio_requests_total metric
• Verify that we can expose a Prometheus data source that filters shared Istio metrics based on user permissions