Add name_validation_scheme limit config

Signed-off-by: SungJin1212 <tjdwls1201@gmail.com>

Author: SungJin1212

docs/configuration/config-file-reference.md

@@ -4344,6 +4344,11 @@ query_rejection:
 
 # list of rule groups to disable
 [disabled_rule_groups: <list of DisabledRuleGroup> | default = []]
+
+# Name validation scheme for metric names and label names, Support values are:
+# legacy, utf8.
+# CLI flag: -validation.name-validation-scheme
+[name_validation_scheme: <int> | default = legacy]
 ```
 
 ### `memberlist_config`

integration/e2e/service.go

@@ -15,6 +15,7 @@ import (
 	"github.com/go-kit/log"
 	"github.com/pkg/errors"
 	"github.com/prometheus/common/expfmt"
+	"github.com/prometheus/common/model"
 	"github.com/thanos-io/thanos/pkg/runutil"
 
 	"github.com/cortexproject/cortex/pkg/util/backoff"
@@ -623,7 +624,7 @@ func (s *HTTPService) SumMetrics(metricNames []string, opts ...MetricsOption) ([
 		return nil, err
 	}
 
-	var tp expfmt.TextParser
+	tp := expfmt.NewTextParser(model.LegacyValidation)
 	families, err := tp.TextToMetricFamilies(strings.NewReader(metrics))
 	if err != nil {
 		return nil, err
@@ -670,7 +671,7 @@ func (s *HTTPService) WaitRemovedMetric(metricName string, opts ...MetricsOption
 		}
 
 		// Parse metrics.
-		var tp expfmt.TextParser
+		tp := expfmt.NewTextParser(model.LegacyValidation)
 		families, err := tp.TextToMetricFamilies(strings.NewReader(metrics))
 		if err != nil {
 			return err

integration/utf8_test.go

@@ -0,0 +1,137 @@
+//go:build requires_docker
+// +build requires_docker
+
+package integration
+
+import (
+	"fmt"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/prometheus/prometheus/prompb"
+	"github.com/stretchr/testify/require"
+
+	"github.com/cortexproject/cortex/integration/e2e"
+	e2edb "github.com/cortexproject/cortex/integration/e2e/db"
+	"github.com/cortexproject/cortex/integration/e2ecortex"
+)
+
+func Test_RulerExternalLabels_UTF8Validation(t *testing.T) {
+	s, err := e2e.NewScenario(networkName)
+	require.NoError(t, err)
+	defer s.Close()
+
+	// Start dependencies.
+	minio := e2edb.NewMinio(9000, bucketName)
+	require.NoError(t, s.StartAndWaitReady(minio))
+
+	runtimeConfigYamlFile := `
+overrides:
+  'user-2':
+    name_validation_scheme: utf8
+    ruler_external_labels:
+      test.utf8.metric: 😄
+`
+	require.NoError(t, writeFileToSharedDir(s, runtimeConfigFile, []byte(runtimeConfigYamlFile)))
+	filePath := filepath.Join(e2e.ContainerSharedDir, runtimeConfigFile)
+
+	// Start Cortex components.
+	require.NoError(t, copyFileToSharedDir(s, "docs/configuration/single-process-config-blocks.yaml", cortexConfigFile))
+
+	flags := map[string]string{
+		"-auth.enabled":           "true",
+		"-runtime-config.file":    filePath,
+		"-runtime-config.backend": "filesystem",
+		// ingester
+		"-blocks-storage.s3.access-key-id":     e2edb.MinioAccessKey,
+		"-blocks-storage.s3.secret-access-key": e2edb.MinioSecretKey,
+		"-blocks-storage.s3.bucket-name":       bucketName,
+		"-blocks-storage.s3.endpoint":          fmt.Sprintf("%s-minio-9000:9000", networkName),
+		"-blocks-storage.s3.insecure":          "true",
+		// alert manager
+		"-alertmanager.web.external-url":   "http://localhost/alertmanager",
+		"-alertmanager-storage.backend":    "local",
+		"-alertmanager-storage.local.path": filepath.Join(e2e.ContainerSharedDir, "alertmanager_configs"),
+	}
+	// make alert manager config dir
+	require.NoError(t, writeFileToSharedDir(s, "alertmanager_configs", []byte{}))
+
+	// The external labels validation should be success
+	cortex := e2ecortex.NewSingleBinaryWithConfigFile("cortex-1", cortexConfigFile, flags, "", 9009, 9095)
+	require.NoError(t, s.StartAndWaitReady(cortex))
+}
+
+func Test_Distributor_UTF8ValidationPerTenant(t *testing.T) {
+	s, err := e2e.NewScenario(networkName)
+	require.NoError(t, err)
+	defer s.Close()
+
+	// Start dependencies.
+	minio := e2edb.NewMinio(9000, bucketName)
+	require.NoError(t, s.StartAndWaitReady(minio))
+
+	runtimeConfigYamlFile := `
+overrides:
+  'user-2':
+    name_validation_scheme: utf8
+`
+
+	require.NoError(t, writeFileToSharedDir(s, runtimeConfigFile, []byte(runtimeConfigYamlFile)))
+	filePath := filepath.Join(e2e.ContainerSharedDir, runtimeConfigFile)
+
+	// Start Cortex components.
+	require.NoError(t, copyFileToSharedDir(s, "docs/configuration/single-process-config-blocks.yaml", cortexConfigFile))
+
+	flags := map[string]string{
+		"-auth.enabled":           "true",
+		"-runtime-config.file":    filePath,
+		"-runtime-config.backend": "filesystem",
+		// ingester
+		"-blocks-storage.s3.access-key-id":     e2edb.MinioAccessKey,
+		"-blocks-storage.s3.secret-access-key": e2edb.MinioSecretKey,
+		"-blocks-storage.s3.bucket-name":       bucketName,
+		"-blocks-storage.s3.endpoint":          fmt.Sprintf("%s-minio-9000:9000", networkName),
+		"-blocks-storage.s3.insecure":          "true",
+		// alert manager
+		"-alertmanager.web.external-url":   "http://localhost/alertmanager",
+		"-alertmanager-storage.backend":    "local",
+		"-alertmanager-storage.local.path": filepath.Join(e2e.ContainerSharedDir, "alertmanager_configs"),
+	}
+	// make alert manager config dir
+	require.NoError(t, writeFileToSharedDir(s, "alertmanager_configs", []byte{}))
+
+	cortex := e2ecortex.NewSingleBinaryWithConfigFile("cortex-1", cortexConfigFile, flags, "", 9009, 9095)
+	require.NoError(t, s.StartAndWaitReady(cortex))
+
+	// user-1 uses legacy validation
+	user1Client, err := e2ecortex.NewClient(cortex.HTTPEndpoint(), "", "", "", "user-1")
+	require.NoError(t, err)
+
+	// user-2 uses utf8 validation
+	user2Client, err := e2ecortex.NewClient(cortex.HTTPEndpoint(), "", "", "", "user-2")
+	require.NoError(t, err)
+
+	now := time.Now()
+
+	utf8Series, _ := generateSeries("series_1", now, prompb.Label{Name: "test.utf8.metric", Value: "😄"})
+	legacySeries, _ := generateSeries("series_2", now, prompb.Label{Name: "job", Value: "test"})
+
+	res, err := user1Client.Push(legacySeries)
+	require.NoError(t, err)
+	require.Equal(t, 200, res.StatusCode)
+
+	// utf8Series push should be fail for user-1
+	res, err = user1Client.Push(utf8Series)
+	require.NoError(t, err)
+	require.Equal(t, 400, res.StatusCode)
+
+	res, err = user2Client.Push(legacySeries)
+	require.NoError(t, err)
+	require.Equal(t, 200, res.StatusCode)
+
+	// utf8Series push should be success for user-2
+	res, err = user2Client.Push(utf8Series)
+	require.NoError(t, err)
+	require.Equal(t, 200, res.StatusCode)
+}

pkg/ruler/external_labels_test.go

@@ -39,6 +39,13 @@ func TestUserExternalLabels(t *testing.T) {
 			userExternalLabels:     labels.FromStrings("from", "cloud", "tag", "local"),
 			expectedExternalLabels: labels.FromStrings("from", "cloud", "tag", "local"),
 		},
+		{
+			name:                   "utf8",
+			removeBeforeTest:       true,
+			exists:                 false,
+			userExternalLabels:     labels.FromStrings("test.utf8.metric", "😄"),
+			expectedExternalLabels: labels.FromStrings("from", "cortex", "test.utf8.metric", "😄"),
+		},
 	}
 
 	const userID = "test-user"

pkg/util/validation/exporter.go

@@ -64,10 +64,13 @@ func ExtractNumericalValues(l *Limits) map[string]float64 {
 
 		switch field.Kind() {
 		case reflect.Int, reflect.Int64:
-			if field.Type().String() == "model.Duration" {
+			switch fieldType.Type.String() {
+			case "model.Duration":
 				// we export the model.Duration in seconds
 				metrics[tag] = time.Duration(field.Int()).Seconds()
-			} else {
+			case "model.ValidationScheme":
+				// skip
+			default:
 				metrics[tag] = float64(field.Int())
 			}
 		case reflect.Uint, reflect.Uint64:

pkg/util/validation/limits.go

@@ -245,6 +245,8 @@ type Limits struct {
 	AlertmanagerMaxSilencesCount               int                `yaml:"alertmanager_max_silences_count" json:"alertmanager_max_silences_count"`
 	AlertmanagerMaxSilencesSizeBytes           int                `yaml:"alertmanager_max_silences_size_bytes" json:"alertmanager_max_silences_size_bytes"`
 	DisabledRuleGroups                         DisabledRuleGroups `yaml:"disabled_rule_groups" json:"disabled_rule_groups" doc:"nocli|description=list of rule groups to disable"`
+
+	NameValidationScheme model.ValidationScheme `yaml:"name_validation_scheme" json:"name_validation_scheme"`
 }
 
 // RegisterFlags adds the flags required to config this to the given FlagSet
@@ -354,6 +356,9 @@ func (l *Limits) RegisterFlags(f *flag.FlagSet) {
 	f.IntVar(&l.AlertmanagerMaxAlertsSizeBytes, "alertmanager.max-alerts-size-bytes", 0, "Maximum total size of alerts that a single user can have, alert size is the sum of the bytes of its labels, annotations and generatorURL. Inserting more alerts will fail with a log message and metric increment. 0 = no limit.")
 	f.IntVar(&l.AlertmanagerMaxSilencesCount, "alertmanager.max-silences-count", 0, "Maximum number of silences that a single user can have, including expired silences. 0 = no limit.")
 	f.IntVar(&l.AlertmanagerMaxSilencesSizeBytes, "alertmanager.max-silences-size-bytes", 0, "Maximum size of individual silences that a single user can have. 0 = no limit.")
+
+	_ = l.NameValidationScheme.Set(model.LegacyValidation.String())
+	f.Var(&l.NameValidationScheme, "validation.name-validation-scheme", fmt.Sprintf("Name validation scheme for metric names and label names, Support values are: %s.", strings.Join([]string{model.LegacyValidation.String(), model.UTF8Validation.String()}, ", ")))
 }
 
 // Validate the limits config and returns an error if the validation
@@ -376,8 +381,18 @@ func (l *Limits) Validate(shardByAllLabels bool, activeSeriesMetricsEnabled bool
 		return errMaxLocalNativeHistogramSeriesPerUserValidation
 	}
 
+	var nameValidationScheme model.ValidationScheme
+	switch l.NameValidationScheme {
+	case model.LegacyValidation, model.UTF8Validation:
+		nameValidationScheme = l.NameValidationScheme
+	case model.UnsetValidation:
+		nameValidationScheme = model.LegacyValidation
+	default:
+		return fmt.Errorf("unsupported name validation scheme: %s", l.NameValidationScheme)
+	}
+
 	if err := l.RulerExternalLabels.Validate(func(l labels.Label) error {
-		if !model.LabelName(l.Name).IsValid() {
+		if !nameValidationScheme.IsValidLabelName(l.Name) {
 			return fmt.Errorf("%w: %q", errInvalidLabelName, l.Name)
 		}
 		if !model.LabelValue(l.Value).IsValid() {

pkg/util/validation/limits_test.go

@@ -123,6 +123,18 @@ func TestLimits_Validate(t *testing.T) {
 			limits:   Limits{RulerExternalLabels: labels.FromStrings("good", string([]byte{0xff, 0xfe, 0xfd}))},
 			expected: errInvalidLabelValue,
 		},
+		"utf8: external-labels utf8 label name and value": {
+			limits:   Limits{NameValidationScheme: model.UTF8Validation, RulerExternalLabels: labels.FromStrings("test.utf8.metric", "😄")},
+			expected: nil,
+		},
+		"utf8: external-labels invalid label name": {
+			limits:   Limits{NameValidationScheme: model.UTF8Validation, RulerExternalLabels: labels.FromStrings("test.\xc5.metric", "😄")},
+			expected: errInvalidLabelName,
+		},
+		"utf8: external-labels invalid label value": {
+			limits:   Limits{NameValidationScheme: model.UTF8Validation, RulerExternalLabels: labels.FromStrings("test.utf8.metric", "test.\xc5.value")},
+			expected: errInvalidLabelValue,
+		},
 	}
 
 	for testName, testData := range tests {
@@ -245,7 +257,7 @@ limits_per_label_set:
 	err := yaml.Unmarshal([]byte(inputYAML), &limitsYAML)
 	require.NoError(t, err)
 	require.Len(t, limitsYAML.LimitsPerLabelSet, 1)
-	require.Len(t, limitsYAML.LimitsPerLabelSet[0].LabelSet, 1)
+	require.Equal(t, 1, limitsYAML.LimitsPerLabelSet[0].LabelSet.Len())
 	require.Equal(t, limitsYAML.LimitsPerLabelSet[0].Limits.MaxSeries, 10)
 
 	duplicatedInputYAML := `

pkg/util/validation/validate.go

@@ -285,7 +285,7 @@ func ValidateLabels(validateMetrics *ValidateMetrics, limits *Limits, userID str
 			return newNoMetricNameError()
 		}
 
-		if !model.IsValidMetricName(model.LabelValue(unsafeMetricName)) {
+		if !limits.NameValidationScheme.IsValidLabelName(unsafeMetricName) {
 			validateMetrics.DiscardedSamples.WithLabelValues(invalidMetricName, userID).Inc()
 			return newInvalidMetricNameError(unsafeMetricName)
 		}
@@ -304,7 +304,7 @@ func ValidateLabels(validateMetrics *ValidateMetrics, limits *Limits, userID str
 	labelsSizeBytes := 0
 
 	for _, l := range ls {
-		if !skipLabelNameValidation && !model.LabelName(l.Name).IsValid() {
+		if !skipLabelNameValidation && !limits.NameValidationScheme.IsValidLabelName(l.Name) {
 			validateMetrics.DiscardedSamples.WithLabelValues(invalidLabel, userID).Inc()
 			return newInvalidLabelError(ls, l.Name)
 		} else if len(l.Name) > maxLabelNameLength {

pkg/util/validation/validate_test.go

@@ -21,6 +21,69 @@ import (
 	util_log "github.com/cortexproject/cortex/pkg/util/log"
 )
 
+func TestValidateLabels_UTF8(t *testing.T) {
+	cfg := new(Limits)
+	userID := "testUser"
+
+	reg := prometheus.NewRegistry()
+	validateMetrics := NewValidateMetrics(reg)
+
+	cfg.MaxLabelValueLength = 25
+	cfg.MaxLabelNameLength = 25
+	cfg.MaxLabelNamesPerSeries = 2
+	cfg.MaxLabelsSizeBytes = 90
+	cfg.EnforceMetricName = true
+	cfg.NameValidationScheme = model.UTF8Validation
+
+	tests := []struct {
+		description             string
+		metric                  model.Metric
+		skipLabelNameValidation bool
+		expectedErr             error
+	}{
+		{
+			description:             "empty metric name",
+			metric:                  map[model.LabelName]model.LabelValue{},
+			skipLabelNameValidation: false,
+			expectedErr:             newNoMetricNameError(),
+		},
+		{
+			description:             "utf8 metric name",
+			metric:                  map[model.LabelName]model.LabelValue{model.MetricNameLabel: "test.utf8.metric"},
+			skipLabelNameValidation: false,
+			expectedErr:             nil,
+		},
+		{
+			description:             "invalid utf8 metric name",
+			metric:                  map[model.LabelName]model.LabelValue{model.MetricNameLabel: "test.\xc5.metric"},
+			skipLabelNameValidation: false,
+			expectedErr:             newInvalidMetricNameError("test.\xc5.metric"),
+		},
+		{
+			description:             "invalid utf8 label name, but skipLabelNameValidation is true",
+			metric:                  map[model.LabelName]model.LabelValue{model.MetricNameLabel: "test.utf8.metric", "label1": "test.\xc5.label"},
+			skipLabelNameValidation: true,
+			expectedErr:             nil,
+		},
+		{
+			description:             "invalid utf8 label name, but skipLabelNameValidation is false",
+			metric:                  map[model.LabelName]model.LabelValue{model.MetricNameLabel: "test.utf8.metric", "test.\xc5.label": "value"},
+			skipLabelNameValidation: false,
+			expectedErr: newInvalidLabelError([]cortexpb.LabelAdapter{
+				{Name: model.MetricNameLabel, Value: "test.utf8.metric"},
+				{Name: "test.\xc5.label", Value: "value"},
+			}, "test.\xc5.label"),
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.description, func(t *testing.T) {
+			err := ValidateLabels(validateMetrics, cfg, userID, cortexpb.FromMetricsToLabelAdapters(test.metric), test.skipLabelNameValidation)
+			assert.Equal(t, test.expectedErr, err, "wrong error")
+		})
+	}
+}
+
 func TestValidateLabels(t *testing.T) {
 	cfg := new(Limits)
 	userID := "testUser"
@@ -33,6 +96,7 @@ func TestValidateLabels(t *testing.T) {
 	cfg.MaxLabelNamesPerSeries = 2
 	cfg.MaxLabelsSizeBytes = 90
 	cfg.EnforceMetricName = true
+	cfg.NameValidationScheme = model.LegacyValidation
 	cfg.LimitsPerLabelSet = []LimitsPerLabelSet{
 		{
 			Limits: LimitsPerLabelSetEntry{MaxSeries: 0},
@@ -271,6 +335,7 @@ func TestValidateLabelOrder(t *testing.T) {
 	cfg.MaxLabelNameLength = 10
 	cfg.MaxLabelNamesPerSeries = 10
 	cfg.MaxLabelValueLength = 10
+	cfg.NameValidationScheme = model.LegacyValidation
 	reg := prometheus.NewRegistry()
 	validateMetrics := NewValidateMetrics(reg)
 	userID := "testUser"
@@ -299,6 +364,7 @@ func TestValidateLabelDuplication(t *testing.T) {
 	cfg.MaxLabelNameLength = 10
 	cfg.MaxLabelNamesPerSeries = 10
 	cfg.MaxLabelValueLength = 10
+	cfg.NameValidationScheme = model.LegacyValidation
 	reg := prometheus.NewRegistry()
 	validateMetrics := NewValidateMetrics(reg)
 	userID := "testUser"

schemas/cortex-config-schema.json

@@ -5184,6 +5184,12 @@
           "description": "List of metric relabel configurations. Note that in most situations, it is more effective to use metrics relabeling directly in the Prometheus server, e.g. remote_write.write_relabel_configs.",
           "type": "string"
         },
+        "name_validation_scheme": {
+          "default": "legacy",
+          "description": "Name validation scheme for metric names and label names, Support values are: legacy, utf8.",
+          "type": "number",
+          "x-cli-flag": "validation.name-validation-scheme"
+        },
         "native_histogram_ingestion_burst_size": {
           "default": 0,
           "description": "Per-user allowed native histogram ingestion burst size (in number of samples)",