supabase-kubernetes
supabase-kubernetes copied to clipboard
Fixes **401 Unauthorized** errors when `vector` forwards logs to `log…
…flare` in self-hosted Kubernetes deployments.
Summary
Fixes 401 Unauthorized errors when vector forwards logs to logflare in self-hosted Kubernetes deployments. The issue was due to authentication method mismatch:
- Old (broken): API key passed via
?api_key=...query param - New (fixed): API key passed via
Authorization: Bearer ...header
This change aligns the Kubernetes Helm chart with the working Docker Compose setup and Logflare’s expected authentication model.
Related Issue
Closes supabase/supabase#37998
Changes
- Updated vector sink configuration in Helm chart:
- Replace
?api_key=SECRET[credentials.logflare_api_key]in sink URIs with standard endpoints. - Add
Authorization: Bearer SECRET[credentials.logflare_api_key]headers in each logflare sink.
- Replace
- Ensured DB sink still routes through Kong for startup ordering.
- No breaking changes for users with correct
LOGFLARE_API_KEY.
Verification
- Deployed Supabase via Helm on Kubernetes.
- Confirmed all pods healthy (
kubectl get pods). - Observed no more
401 Unauthorizederrors in vector logs. - Logs successfully appear in Logflare dashboard.
- Curling
/healthon logflare pod returns200 OKas before.
Checklist
- [x] Verified in Kubernetes environment
- [x] Ensured parity with Docker Compose behavior
- [x] Helm values backward-compatible
- [ ] Added release note
Release Note
Fixed an authentication bug where `vector` failed with `401 Unauthorized` when sending logs to `logflare` in self-hosted Kubernetes deployments.
Authentication is now handled via `Authorization: Bearer <LOGFLARE_API_KEY>` headers instead of query parameters.
## What kind of change does this PR introduce?
Bug fix, feature, docs update, ...
## What is the current behavior?
Please link any relevant issues here.
## What is the new behavior?
Feel free to include screenshots if it includes visual changes.
## Additional context
Add any other context or screenshots.