Skip to content

[Backport 3.5] Fix issue connecting with prometheus by wrapping with AccessController.doPrivilegedChecked (#5061) #5101

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Swiddis merged 1 commit into from
Feb 2, 2026
Merged

[Backport 3.5] Fix issue connecting with prometheus by wrapping with AccessController.doPrivilegedChecked (#5061) #5101

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 15 additions & 14 deletions ...t-query-core/src/main/java/org/opensearch/sql/prometheus/client/PrometheusClientImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@
import org.json.JSONArray;
import org.json.JSONException;
import org.json.JSONObject;
import org.opensearch.secure_sm.AccessController;
import org.opensearch.sql.prometheus.exception.PrometheusClientException;
import org.opensearch.sql.prometheus.model.MetricMetadata;

Expand Down Expand Up @@ -91,7 +92,7 @@ public JSONObject queryRange(
Request request = new Request.Builder().url(queryUrl).build();

logger.debug("Executing Prometheus request with headers: {}", request.headers().toString());
Response response = this.prometheusHttpClient.newCall(request).execute();
Response response = AccessController.doPrivilegedChecked(() -> this.prometheusHttpClient.newCall(request).execute());

logger.debug("Received Prometheus response for query_range: code={}", response);

Expand Down Expand Up @@ -126,7 +127,7 @@ public JSONObject query(String query, Long time, Integer limit, Integer timeout)
Request request = new Request.Builder().url(queryUrl).build();

logger.info("Executing Prometheus request with headers: {}", request.headers().toString());
Response response = this.prometheusHttpClient.newCall(request).execute();
Response response = AccessController.doPrivilegedChecked(() -> this.prometheusHttpClient.newCall(request).execute());

logger.info("Received Prometheus response for instant query: code={}", response);
// Return the full response object, not just the data field
Expand All @@ -146,7 +147,7 @@ public List<String> getLabels(Map<String, String> queryParams) throws IOExceptio
"%s/api/v1/labels%s", prometheusUri.toString().replaceAll("/$", ""), queryString);
logger.debug("queryUrl: " + queryUrl);
Request request = new Request.Builder().url(queryUrl).build();
Response response = this.prometheusHttpClient.newCall(request).execute();
Response response = AccessController.doPrivilegedChecked(() -> this.prometheusHttpClient.newCall(request).execute());
JSONObject jsonObject = readResponse(response);
return toListOfLabels(jsonObject.getJSONArray("data"));
}
Expand All @@ -161,7 +162,7 @@ public List<String> getLabel(String labelName, Map<String, String> queryParams)
prometheusUri.toString().replaceAll("/$", ""), labelName, queryString);
logger.debug("queryUrl: " + queryUrl);
Request request = new Request.Builder().url(queryUrl).build();
Response response = this.prometheusHttpClient.newCall(request).execute();
Response response = AccessController.doPrivilegedChecked(() -> this.prometheusHttpClient.newCall(request).execute());
JSONObject jsonObject = readResponse(response);
return toListOfLabels(jsonObject.getJSONArray("data"));
}
Expand All @@ -175,7 +176,7 @@ public Map<String, List<MetricMetadata>> getAllMetrics(Map<String, String> query
"%s/api/v1/metadata%s", prometheusUri.toString().replaceAll("/$", ""), queryString);
logger.debug("queryUrl: " + queryUrl);
Request request = new Request.Builder().url(queryUrl).build();
Response response = this.prometheusHttpClient.newCall(request).execute();
Response response = AccessController.doPrivilegedChecked(() -> this.prometheusHttpClient.newCall(request).execute());
JSONObject jsonObject = readResponse(response);
TypeReference<HashMap<String, List<MetricMetadata>>> typeRef = new TypeReference<>() {};
return new ObjectMapper().readValue(jsonObject.getJSONObject("data").toString(), typeRef);
Expand All @@ -194,7 +195,7 @@ public List<Map<String, String>> getSeries(Map<String, String> queryParams) thro
"%s/api/v1/series%s", prometheusUri.toString().replaceAll("/$", ""), queryString);
logger.debug("queryUrl: " + queryUrl);
Request request = new Request.Builder().url(queryUrl).build();
Response response = this.prometheusHttpClient.newCall(request).execute();
Response response = AccessController.doPrivilegedChecked(() -> this.prometheusHttpClient.newCall(request).execute());
JSONObject jsonObject = readResponse(response);
JSONArray dataArray = jsonObject.getJSONArray("data");
return toListOfSeries(dataArray);
Expand All @@ -211,7 +212,7 @@ public JSONArray queryExemplars(String query, Long start, Long end) throws IOExc
end);
logger.debug("queryUrl: " + queryUrl);
Request request = new Request.Builder().url(queryUrl).build();
Response response = this.prometheusHttpClient.newCall(request).execute();
Response response = AccessController.doPrivilegedChecked(() -> this.prometheusHttpClient.newCall(request).execute());
JSONObject jsonObject = readResponse(response);
return jsonObject.getJSONArray("data");
}
Expand All @@ -222,7 +223,7 @@ public JSONObject getAlerts() throws IOException {
String.format("%s/api/v1/alerts", prometheusUri.toString().replaceAll("/$", ""));
logger.debug("Making Prometheus alerts request: {}", queryUrl);
Request request = new Request.Builder().url(queryUrl).build();
Response response = this.prometheusHttpClient.newCall(request).execute();
Response response = AccessController.doPrivilegedChecked(() -> this.prometheusHttpClient.newCall(request).execute());
JSONObject jsonObject = readResponse(response);
return jsonObject.getJSONObject("data");
}
Expand All @@ -235,7 +236,7 @@ public JSONObject getRules(Map<String, String> queryParams) throws IOException {
"%s/api/v1/rules%s", prometheusUri.toString().replaceAll("/$", ""), queryString);
logger.debug("Making Prometheus rules request: {}", queryUrl);
Request request = new Request.Builder().url(queryUrl).build();
Response response = this.prometheusHttpClient.newCall(request).execute();
Response response = AccessController.doPrivilegedChecked(() -> this.prometheusHttpClient.newCall(request).execute());
JSONObject jsonObject = readResponse(response);
return jsonObject.getJSONObject("data");
}
Expand All @@ -248,7 +249,7 @@ public JSONArray getAlertmanagerAlerts(Map<String, String> queryParams) throws I

logger.debug("Making Alertmanager alerts request: {}", queryUrl);
Request request = new Request.Builder().url(queryUrl).build();
Response response = this.alertmanagerHttpClient.newCall(request).execute();
Response response = AccessController.doPrivilegedChecked(() -> this.alertmanagerHttpClient.newCall(request).execute());

return readAlertmanagerResponse(response);
}
Expand All @@ -261,7 +262,7 @@ public JSONArray getAlertmanagerAlertGroups(Map<String, String> queryParams) thr

logger.debug("Making Alertmanager alert groups request: {}", queryUrl);
Request request = new Request.Builder().url(queryUrl).build();
Response response = this.alertmanagerHttpClient.newCall(request).execute();
Response response = AccessController.doPrivilegedChecked(() -> this.alertmanagerHttpClient.newCall(request).execute());

return readAlertmanagerResponse(response);
}
Expand All @@ -273,7 +274,7 @@ public JSONArray getAlertmanagerReceivers() throws IOException {

logger.debug("Making Alertmanager receivers request: {}", queryUrl);
Request request = new Request.Builder().url(queryUrl).build();
Response response = this.alertmanagerHttpClient.newCall(request).execute();
Response response = AccessController.doPrivilegedChecked(() -> this.alertmanagerHttpClient.newCall(request).execute());

return readAlertmanagerResponse(response);
}
Expand All @@ -285,7 +286,7 @@ public JSONArray getAlertmanagerSilences() throws IOException {

logger.debug("Making Get Alertmanager silences request: {}", queryUrl);
Request request = new Request.Builder().url(queryUrl).build();
Response response = this.alertmanagerHttpClient.newCall(request).execute();
Response response = AccessController.doPrivilegedChecked(() -> this.alertmanagerHttpClient.newCall(request).execute());

return readAlertmanagerResponse(response);
}
Expand All @@ -301,7 +302,7 @@ public String createAlertmanagerSilences(String silenceJson) throws IOException
.header("Content-Type", "application/json")
.post(RequestBody.create(silenceJson.getBytes(StandardCharsets.UTF_8)))
.build();
Response response = this.alertmanagerHttpClient.newCall(request).execute();
Response response = AccessController.doPrivilegedChecked(() -> this.alertmanagerHttpClient.newCall(request).execute());

if (response.isSuccessful()) {
return Objects.requireNonNull(response.body()).string();
Expand Down
Loading