<p>I am running Grafana v6.2.4 in kubernetes, using basic auth. I want to use the k8s proxy for testing (i.e. <code>kubectl proxy --port=8080</code>). I have changed the <code>GF_SERVER_ROOT_URL</code> environment variable to:</p>

<pre><code>{
    "name": "GF_SERVER_ROOT_URL",
    "value": "http://localhost:8080/api/v1/namespaces/my-namespace/services/grafana-prom:80/proxy/"
}
</code></pre>

<p>This allows me to log in and use Grafana through my browser at <code>http://localhost:8080/api/v1/namespaces/my-namespace/services/grafana-prom:80/proxy/</code>. </p>

<p>However, I want to use it via the API. If I send a request to <code>http://localhost:8080/api/v1/namespaces/my-namespace/services/grafana-prom:80/proxy/api/dashboards/db</code> I get back</p>

<pre><code>{
    "message": "Unauthorized"
}
</code></pre>

<p>However, if I set up a kubernetes port forward and send the identical request to <code>http://localhost:30099/api/dashboards/db</code>, then it succeeds.</p>

<p>Is there a different environment variable aside from <code>GF_SERVER_ROOT_URL</code> that I should be changing so that the API server root goes through the k8s proxy, i.e. <code>http://localhost:8080/api/v1/namespaces/my-namespace/services/grafana-prom:80/proxy/api/dashboards/db</code>? I have looked <a href="https://grafana.com/docs/installation/configuration/#root-url" rel="nofollow noreferrer">here</a> but couldn't find it. </p>

<p>Otherwise what is the correct way to access the API through the k8s proxy?</p>

<p>I should add that I am specifically trying to use <code>kubetctl proxy</code> as an alternative to <code>kubectl port-forward</code> so I'm hoping to find an alternative to the suggestion here <a href="https://stackoverflow.com/a/45189081/1011724">https://stackoverflow.com/a/45189081/1011724</a></p>

Dan
<p>I tried to replicate this in <code>minikube</code> and i might have found the reason for your requests through the API server proxy (using <code>kubectl proxy</code>) not getting authorized correctly.</p>

<p>Running the following <code>curl</code>-command:</p>

<pre><code>curl -H "Authorization: Bearer &lt;TOKEN&gt;" http://localhost:8080/api/v1/namespaces/my-namespace/services/grafana-prom:80/proxy/api/dashboards/home
</code></pre>

<p>and using <code>tcpdump</code> to capture the requests in the Pod with <code>tcpdump -vvvs 0 -l -A -i any</code> yielded the following result(s):</p>

<pre><code>GET /api/dashboards/home HTTP/1.1                                                                            
Host: localhost:8080                                                                                                 
User-Agent: curl/7.58.0                                                                                              
Accept: */*                                                                                                          
Accept-Encoding: gzip                                                                                                
X-Forwarded-For: 127.0.0.1, 192.168.99.1                                                                             
X-Forwarded-Uri: /api/v1/namespaces/my-namespace/services/grafana-prom:80/proxy/api/dashboards/home
</code></pre>

<p>This <code>GET</code> request doesn't have the <code>Authorization</code> header (resulting in a <code>401 Unauthorized</code>) so basically the API server seem to strip this HTTP header as it passes the request down to the Pod.</p>

<p>If i instead use <code>kubectl port-forward -n my-namespace svc/grafana-prom 8080:80</code> the <code>GET</code> request now looks like this:</p>

<pre><code>GET /api/dashboards/home HTTP/1.1                                                                            
Host: localhost:8080                                                                                                 
User-Agent: curl/7.58.0                                                                                              
Accept: */*                                                                                                          
Authorization: Bearer &lt;TOKEN&gt;
</code></pre>

<p>When writing this answer i found this issue in the k/k repo <a href="https://github.com/kubernetes/kubernetes/issues/38775" rel="nofollow noreferrer">#38775</a>, to qoute one of the comments:</p>

<blockquote>
  <p>this is working as expected. "proxying" through the apiserver will not get you standard proxy behavior (preserving Authorization headers end-to-end), because the API is not being used as a standard proxy</p>
</blockquote>

<p>This basically means that <code>kubectl proxy</code> will not work when trying to authorize through it, it's not a "regular" reverse proxy and probably for a good reason won't preserve <code>Authorization</code> headers.</p>

<p>Note that i tested both token and basic authorization using <code>curl</code> although token based auth is used above.</p>

<p>Hopefully this clear things up a bit!</p>
