PromQL Guard

PromQL Guard is a lightweight proxy that sits between clients (like Grafana) and Prometheus servers. It inspects and rewrites Prometheus Query Language (PromQL) queries to enforce data access restrictions, ensuring tenants can only view their own metrics even when sharing a single Prometheus backend. This enables secure multi-tenancy for monitoring setups without modifying Prometheus itself.

Key Features

• Query Rewriting — Automatically injects label matchers into PromQL queries based on tenant configuration to restrict data access.
• Multi-Tenant Support — Allows multiple tenants to share a Prometheus server while maintaining strict data isolation between them.
• Grafana Integration — Designed to work seamlessly as a Prometheus datasource in Grafana, supporting Viewer and Editor roles.
• Flexible Configuration — Supports different label matching strategies (exact matches, regex) and can proxy to various upstream Prometheus-compatible servers (e.g., Prometheus, Thanos).
• Authentication Integration — Uses htpasswd files for tenant authentication, integrating with existing credential management.

Philosophy

PromQL Guard takes a minimal, proxy-based approach to multi-tenancy, avoiding modifications to Prometheus itself and leveraging PromQL's native label filtering capabilities for security.