# Ingestion Authentication with API Key

To enable authentication for ingestion using API keys, perform these steps:

- [Generate the AUTH_TOKEN](https://docs.kloudfuse.com/platform/4.0.2/administration/authentication/ingestion-api-key/#auth-token)
- [Configure Telemetry Agents and Sources](https://docs.kloudfuse.com/platform/4.0.2/administration/authentication/ingestion-api-key/#agents)
- [Configure kfuse](https://docs.kloudfuse.com/platform/4.0.2/administration/authentication/ingestion-api-key/#kfuse)
- [Restart the Ingester](https://docs.kloudfuse.com/platform/4.0.2/administration/authentication/ingestion-api-key/#restart)

## Generate the AUTH_TOKEN

1. Generate an `AUTH_TOKEN`, and store its value in a safe location. You use it repeatedly.

```console
   AUTH_TOKEN=`cat /dev/urandom | env LC_ALL=C tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1`
   ```

2. Encode the `AUTH_TOKEN` using Base64; this generates the `AUTH_TOKEN_ENCODED`.

```console
   AUTH_TOKEN_ENCODED=`echo -n $AUTH_TOKEN | base64`
   ```

## Configure Telemetry Agents and Sources

### Prometheus Remote Write

1. Update the prometheus remote write configuration:

```yaml
   prometheus.yml:
        remote_write:
     - url: https://<customer>.kloudfuse.io/ingester/write
       authorization:
         credentials: <AUTH_TOKEN>
   ```

2. When using the Prometheus operator, use the following configuration that contains the `AuthToken`:

```yaml
   remoteWrite:
     - authorization:
         credentials:
           key: <AUTH_TOKEN> (1)
           name: kf-auth-ingest (2)
       url: https://<customer>.kloudfuse.io/ingester/write
   ```

|     |     |
   | --- | --- |
   | **1** | `<AUTH_TOKEN>`: The key inside this secret that contains the encoded `authToken`. |
   | **2** | `kf-auth-ingest`: The secret name. |

### Fluent Bit

1. In the HTTP plugin section of the fluent-bit configuration file, update or add the `header` field using the new `AUTH_TOKEN` value (from the previous step):

```yaml
   [OUTPUT]
          Name http
          Match <match_pattern>
          Host <kfuse_ingress_ip>
          Port 443
          TLS on
          URI /ingester/v1/fluent_bit
          header Kf-Api-Key <AUTH_TOKEN>
   ```

2. Use the Kubernetes Secret to set the `Kf-Api-Key`.
   1. Create the secret:
   
      ```yaml
      apiVersion: v1
      kind: Secret
      metadata:
        name: <<secret-name>>
      type: Opaque
      data:
        AUTH_KEY_ENV: AUTH_TOKEN_ENCODED
      ```

2. Update the fluent-bit helm using the `custom-values.yaml` file:

```yaml
      env:
   - name: AUTH_KEY_ENV
   valueFrom:
         secretKeyRef:
           name: <<secret-name>>
           key: AUTH_KEY_ENV

config:
   outputs: |
       [OUTPUT]
           Name http
           Header Kf-Api-Key ${AUTH_KEY_ENV}
           Match *
           Host dev.kloudfuse.io
           Port 443
           TLS on
           URI /ingester/v1/fluent_bit
           Format {json|json_lines|json_stream|msgpack}
      ```

### Fluentd

1. In the HTTP plugin section of the Fluentd configuration file, update or add the `headers` field using the new `Kf_Api-Key` and `AUTH_TOKEN` value (from the previous step):

```yaml
   <match *> # Match everything
   @type http
   endpoint http://<KFUSE_INGESTER_IP>:80/ingester/v1/fluentd
   headers {"Kf-Api-Key" : "<AUTH_TOKEN>"}
   ...
   </match>
   ```

### Filebeat

In the output section, include the `api_key` field to update or add a filebeat configuration.

```yaml
output.elasticsearch:
hosts: ["http://<ingress-ip>:80/ingester/api/v1/filebeat"]
api_key: "<AUTH_TOKEN>"
```

### OLTP Collector for Metrics, Logs, and Traces

In the exporters section, include the `api_key` field using `AUTH_TOKEN` value to update or add an OLTP configuration.

```yaml
exporters:
otlphttp:
    endpoint: https://<ingress-address>/ingester/otlp/metrics
    traces_endpoint: https://<ingress-address>/ingester/otlp/traces
    headers:
      kf-api-key: <AUTH_TOKEN>
```

### DataDog agent

Include the `api_key` field using `AUTH_TOKEN` value to update or add a DataDog configuration.

```yaml
datadog:
apiKey: <AUTH_TOKEN>
```

### AWS CloudWatch Metrics and Logs (Kinesis)

When configuring kinesis firehose data stream to send logs or metrics from Cloudwatch, use the `AUTH_TOKEN` value as the access token.

### AWS Eventbridge Events

When [AWS EventBridge Integration with Kloudfuse](https://docs.kloudfuse.com/platform/4.0.2/data-collection/cloud-services/aws/eventbridge/) to ingest to Kloudfuse, use `AUTH_TOKEN` as the value for the `Kf-Api-Key`.

### Heroku Logs

For Heroku logs authentication, follow the steps in [Configure kfuse](https://docs.kloudfuse.com/platform/4.0.2/administration/authentication/ingestion-api-key/#kfuse)
and apply the encoded auth token to the kfuse-auth-ingest secret.

Once the secret is added, add the auth token as the `kf-api-key` parameter in the drain URL as described in [Heroku Log Ingestion](https://docs.kloudfuse.com/platform/4.0.2/data-collection/agents/other/agent-heroku/)

## Configure kfuse

Use the base64-encoded value of the `AUTH_TOKEN`, `AUTH_TOKEN_ENCODED`, to create a kubernetes secret `kfuse-auth-ingest`:

```yaml
apiVersion: v1
kind: Secret
metadata:
name: kfuse-auth-ingest
type: Opaque
data:
authToken: <AUTH_TOKEN_ENCODED>
```

### Multiple Authorization Keys

You can configure multiple authorization tokens inside the secret. These tokens can contain any string value, and become a human-readable identifier to reference the AUTH_TOKEN.

Note that in the following example, we have both `authkey1` and `authkey2`:

```yaml
apiVersion: v1
kind: Secret
metadata:
name: kfuse-auth-ingest
type: Opaque
data:
authkey1: <AUTH_TOKEN_ENCODED>
authkey2: <AUTH_TOKEN_ENCODED2>
```

Update the `custom-values.yaml` file to enable ingestion authentication:

```yaml
global:
authConfig:
    enabled: true
```

### Additional Labels Based on AUTH_TOKEN

You can configure additional labels to attach to ingested time data, and base these labels on the auth token of the incoming payload.

To configure additional labels, add the following settings to the `custom-values.yaml` file. Note that Kloudfuse uses the same keys in the secret and in the ingester configuration:

```yaml
ingester:
config:
     authKeyAdditionalLabels:
        authkey1:
          - name: label1
            value: val1
          - name: label2
            value: val2
        authkey2:
          - name: label1
            value: val3
          - name: label4
            value: val4
```

## Restart the Ingester

After saving the configuration, restart the ingester service:

```console
kubectl rollout restart statefulset ingester
```