rob-1126: support centralized prometheus/alertmanager

Author: nherment

.gitignore

@@ -21,3 +21,5 @@ skaffold.dev.yaml
 tests/last_used_tag.txt
 pytest.ini
 gen-config-test
+
+**/.claude/settings.local.json

playbooks/robusta_playbooks/krr.py

@@ -230,6 +230,7 @@ def _generate_prometheus_secrets(prom_config: PrometheusConfig) -> List[KRRSecre
     # needed for custom bearer token or Azure
     headers = PrometheusAuthorization.get_authorization_headers(prom_config)
     auth_header = headers["Authorization"] if "Authorization" in headers else ""
+    additional_headers = prom_config["headers"] if "headers" in prom_config else None
 
     if auth_header:
         krr_secrets.append(
@@ -240,6 +241,21 @@ def _generate_prometheus_secrets(prom_config: PrometheusConfig) -> List[KRRSecre
                 command_flag="--prometheus-auth-header",
             )
         )
+    
+    if additional_headers:
+        for header_name, header_value in prom_config.headers.items():
+                
+            env_var_name = f"PROMETHEUS_HEADER_{header_name.upper().replace('-', '_')}"
+            secret_key = f"prometheus-header-{header_name.lower()}"
+            
+            krr_secrets.append(
+                KRRSecret(
+                    env_var_name=env_var_name,
+                    secret_key=secret_key,
+                    secret_value=header_value,
+                    command_flag=f"--prometheus-header {header_name}:",
+                )
+            )
 
     if isinstance(prom_config, AWSPrometheusConfig):
         krr_secrets.extend(

src/robusta/core/model/base_params.py

@@ -310,6 +310,7 @@ class PrometheusParams(ActionParams):
     :var prometheus_url: Prometheus url. If omitted, we will try to find a prometheus instance in the same cluster
     :var prometheus_auth: Prometheus auth header to be used in Authorization header. If omitted, we will not add any auth header
     :var prometheus_url_query_string: Additional query string parameters to be appended to the Prometheus connection URL
+    :var prometheus_additional_headers: additional HTTP headers (if defined) to add to every prometheus query
     :var prometheus_additional_labels: A dictionary of additional labels needed for multi-cluster prometheus
     :var add_additional_labels: adds the additional labels (if defined) to the query
 
@@ -325,6 +326,7 @@ class PrometheusParams(ActionParams):
     prometheus_url: Optional[str] = None
     prometheus_auth: Optional[SecretStr] = None
     prometheus_url_query_string: Optional[str] = None
+    prometheus_additional_headers: Optional[Dict[str, str]] = None
     prometheus_additional_labels: Optional[Dict[str, str]] = None
     add_additional_labels: bool = True
     prometheus_graphs_overrides: Optional[List[OverrideGraph]] = None

src/robusta/integrations/prometheus/utils.py

@@ -49,6 +49,7 @@ def generate_prometheus_config(prometheus_params: PrometheusParams) -> Prometheu
         "disable_ssl": not PROMETHEUS_SSL_ENABLED,
         "additional_labels": prometheus_params.prometheus_additional_labels,
         "prometheus_url_query_string": prometheus_params.prometheus_url_query_string,
+        "headers": prometheus_params.prometheus_additional_headers
     }
     if prometheus_params.prometheus_auth:
         baseconfig["prometheus_auth"] = prometheus_params.prometheus_auth.get_secret_value()

src/robusta/utils/silence_utils.py

@@ -56,11 +56,13 @@ def to_list(self) -> List[str]:
 class AlertManagerParams(ActionParams):
     """
     :var alertmanager_url: Alternative Alert Manager url to send requests.
+    :var alertmanager_additional_headers: additional HTTP headers (if defined) to add to every alertmanager request
     """
 
     alertmanager_flavor: str = None  # type: ignore
     alertmanager_url: Optional[str]
     alertmanager_auth: Optional[SecretStr] = None
+    alertmanager_additional_headers: Optional[Dict[str, str]] = None
     grafana_api_key: str = None  # type: ignore
 
     @validator("alertmanager_url", allow_reuse=True)
@@ -143,6 +145,9 @@ def gen_alertmanager_headers(params: AlertManagerParams) -> Dict:
 
     elif params.alertmanager_auth:
         headers.update({"Authorization": params.alertmanager_auth.get_secret_value()})
+        
+    if params.alertmanager_additional_headers:
+        headers.update(params.alertmanager_additional_headers)
 
     return headers