{"record":{"id":"4df5003a245d2a07","repo":"thanos-io/thanos","slug":"query-frontend-org-id-header-and-query-frontend-te","errorCode":null,"errorMessage":"query-frontend.org-id-header and query-frontend.tenant-header cannot be used together","messagePattern":"query-frontend\\.org-id-header and query-frontend\\.tenant-header cannot be used together","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/thanos/query_frontend.go","lineNumber":259,"sourceCode":"\nfunc runQueryFrontend(\n\tg *run.Group,\n\tlogger log.Logger,\n\treg *prometheus.Registry,\n\ttracer opentracing.Tracer,\n\thttpLogOpts []logging.Option,\n\tcfg *queryFrontendConfig,\n\tcomp component.Component,\n) error {\n\ttenantHeaderProvided := cfg.TenantHeader != \"\" && cfg.TenantHeader != tenancy.DefaultTenantHeader\n\t// If tenant header is set and different from the default tenant header, add it to the list of org id headers.\n\t// In this case we don't need to add the tenant header to `cfg.ForwardHeaders` because tripperware will modify\n\t// the request, renaming the tenant header to the default tenant header, before the header propagation logic runs.\n\t// TODO: This should be removed once the org id header is fully removed in Thanos.\n\tif tenantHeaderProvided {\n\t\t// If tenant header is provided together with the org id header, error out.\n\t\tif len(cfg.orgIdHeaders) != 0 {\n\t\t\treturn errors.New(\"query-frontend.org-id-header and query-frontend.tenant-header cannot be used together\")\n\t\t}\n\n\t\tcfg.orgIdHeaders = append(cfg.orgIdHeaders, cfg.TenantHeader)\n\t}\n\n\t// Temporarily manually adding the default tenant header into the list of headers to forward and org id headers.\n\t// This facilitates the transition from org id to tenant id with minimal amount of changes.\n\tcfg.ForwardHeaders = append(cfg.ForwardHeaders, tenancy.DefaultTenantHeader)\n\t// TODO: This should be removed once the org id header is fully removed in Thanos.\n\tcfg.orgIdHeaders = append(cfg.orgIdHeaders, tenancy.DefaultTenantHeader)\n\n\tqueryRangeCacheConfContentYaml, err := cfg.QueryRangeConfig.CachePathOrContent.Content()\n\tif err != nil {\n\t\treturn err\n\t}\n\tif len(queryRangeCacheConfContentYaml) > 0 {\n\t\tcacheConfig, err := queryfrontend.NewCacheConfig(logger, queryRangeCacheConfContentYaml)\n\t\tif err != nil {","sourceCodeStart":241,"sourceCodeEnd":277,"githubUrl":"https://github.com/thanos-io/thanos/blob/35b8b991177def87ed52dcf10f9b6d87f07282c8/cmd/thanos/query_frontend.go#L241-L277","documentation":"Thanos query-frontend rejects using --query-frontend.org-id-header together with --query-frontend.tenant-header. The tenant header flag supersedes the deprecated org-id header, so specifying both is ambiguous and treated as a configuration conflict. This is a deliberate validation in runQueryFrontend.","triggerScenarios":"Starting query-frontend with both --query-frontend.org-id-header (or repeated org-id flags) and --query-frontend.tenant-header set to non-default values.","commonSituations":"Migrating multi-tenancy setups where ops added the new tenant-header flag but forgot to remove the old org-id-header flag from the deployment manifest.","solutions":["Remove the --query-frontend.org-id-header flag and keep only --query-frontend.tenant-header.","If org-id-header is still needed (legacy), remove --query-frontend.tenant-header instead.","Update Helm/manifest values so only one of the two flags is set.","Plan migration to tenant-header as org-id-header is slated for removal."],"exampleFix":"// before\nargs:\n  - --query-frontend.org-id-header=X-Scope-OrgID\n  - --query-frontend.tenant-header=X-Scope-Tenant\n// after\nargs:\n  - --query-frontend.tenant-header=X-Scope-Tenant","handlingStrategy":"validation","validationCode":"const (\n  orgID  = \"--query-frontend.org-id-header\"\n  tenant = \"--query-frontend.tenant-header\"\n)\nif hasFlag(orgID) && hasFlag(tenant) {\n  return errors.New(\"use either org-id-header or tenant-header, not both\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Migrate fully to tenant-header and delete org-id-header everywhere","Grep deployment manifests/Helm values for both flags","Add CI check forbidding the flag combination"],"tags":["config","cli","multi-tenancy"],"backgroundTag":"mutually-exclusive-flags","analyzedSha":"35b8b991177def87ed52dcf10f9b6d87f07282c8","analyzedAt":"2026-09-07T01:49:59.689Z","contentChangedAt":"2026-09-07T01:49:59.689Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}