Skip to content

Commit ac2b6b7

Browse files
mglotovmglotov
authored
enh: use basic auth for Grafana by default and feature flag to switch between basic auth, github oauth and gitlab oauth (#215)
1 parent 1ebceb5 commit ac2b6b7

File tree

4 files changed

+65
-51
lines changed

4 files changed

+65
-51
lines changed

‎README.md‎

Lines changed: 2 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -265,24 +265,9 @@ $ cp terraform/layer1-aws/demo.tfvars.example terraform/layer1-aws/terraform.tfv
265265
> You can find all possible variables in each layer's Readme.
266266
267267
#### Secrets
268+
Some local variables expect [AWS Secrets Manager](https://console.aws.amazon.com/secretsmanager/home?region=us-east-1#!/home) secret with the pattern `/${local.name_wo_region}/infra/layer2-k8s`.
268269

269-
In the root of `layer2-k8s` is the `aws-sm-secrets.tf` where several local variables expect [AWS Secrets Manager](https://console.aws.amazon.com/secretsmanager/home?region=us-east-1#!/home) secret with the pattern `/${local.name_wo_region}/infra/layer2-k8s`. These secrets are used for authentication with Kibana and Grafana using GitLab and register gitlab runner.
270-
271-
```json
272-
{
273-
"kibana_gitlab_client_id": "access key token",
274-
"kibana_gitlab_client_secret": "secret key token",
275-
"kibana_gitlab_group": "gitlab group",
276-
"grafana_gitlab_client_id": "access key token",
277-
"grafana_gitlab_client_secret": "secret key token",
278-
"gitlab_registration_token": "gitlab-runner token",
279-
"grafana_gitlab_group": "gitlab group",
280-
"alertmanager_slack_url": "slack url",
281-
"alertmanager_slack_channel": "slack channel"
282-
}
283-
```
284-
285-
> Set proper secrets; you also can set empty/mock values.
270+
> The secret `/${local.name_wo_region}/infra/layer2-k8s` must be pre-created before running `terraform apply`
286271
287272
#### Domain and SSL
288273

‎docs/FAQ.md‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -211,4 +211,14 @@ runners:
211211
serviceAccountName: my-gitlab-runners-sa
212212
image: ubuntu:18.04
213213
...
214-
```
214+
```
215+
216+
## Grafana: How to add GitHub/Gitlab OAuth2 Authentication:
217+
By default we install Grafana without integrating it with GitHub or Gitlab and use basic authentication (login/password). If you want to integrate it to use OAuth2, then do next:
218+
1. Set `grafana_oauth_type` variable in the `terraform/layer2-k8s/eks-kube-prometheus-stack.tf` to the desired value (github or gitlab).
219+
2. **Gitlab**:
220+
* See [this instruction](https://grafana.com/docs/grafana/latest/auth/gitlab/#gitlab-oauth2-authentication) and generate necessary tokens.
221+
* Set `grafana_gitlab_client_id`, `grafana_gitlab_client_secret`, `grafana_gitlab_group` variables in [AWS Secrets Manager](https://console.aws.amazon.com/secretsmanager/home?region=us-east-1#!/home) secret with the pattern `/${local.name_wo_region}/infra/layer2-k8s`.
222+
3. **GitHub**:
223+
* See [this instruction](https://grafana.com/docs/grafana/latest/auth/github/#github-oauth2-authentication)
224+
* Set `grafana_github_client_id`, `grafana_github_client_secret`, `grafana_github_team_ids`, `grafana_github_allowed_organizations` variables in [AWS Secrets Manager](https://console.aws.amazon.com/secretsmanager/home?region=us-east-1#!/home) secret with the pattern `/${local.name_wo_region}/infra/layer2-k8s`.

‎terraform/layer2-k8s/aws-sm-secrets.tf‎

Lines changed: 6 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,10 @@
11
locals {
2-
kibana_gitlab_client_id = jsondecode(data.aws_secretsmanager_secret_version.infra.secret_string)["kibana_gitlab_client_id"]
3-
kibana_gitlab_client_secret = jsondecode(data.aws_secretsmanager_secret_version.infra.secret_string)["kibana_gitlab_client_secret"]
4-
kibana_gitlab_group = jsondecode(data.aws_secretsmanager_secret_version.infra.secret_string)["kibana_gitlab_group"]
5-
grafana_gitlab_client_id = jsondecode(data.aws_secretsmanager_secret_version.infra.secret_string)["grafana_gitlab_client_id"]
6-
grafana_gitlab_client_secret = jsondecode(data.aws_secretsmanager_secret_version.infra.secret_string)["grafana_gitlab_client_secret"]
7-
gitlab_registration_token = jsondecode(data.aws_secretsmanager_secret_version.infra.secret_string)["gitlab_registration_token"]
8-
grafana_gitlab_group = jsondecode(data.aws_secretsmanager_secret_version.infra.secret_string)["grafana_gitlab_group"]
9-
alertmanager_slack_url = jsondecode(data.aws_secretsmanager_secret_version.infra.secret_string)["alertmanager_slack_url"]
10-
alertmanager_slack_channel = jsondecode(data.aws_secretsmanager_secret_version.infra.secret_string)["alertmanager_slack_channel"]
2+
kibana_gitlab_client_id = lookup(jsondecode(data.aws_secretsmanager_secret_version.infra.secret_string), "kibana_gitlab_client_id", "mock_value")
3+
kibana_gitlab_client_secret = lookup(jsondecode(data.aws_secretsmanager_secret_version.infra.secret_string), "kibana_gitlab_client_secret", "mock_value")
4+
kibana_gitlab_group = lookup(jsondecode(data.aws_secretsmanager_secret_version.infra.secret_string), "kibana_gitlab_group", "mock_value")
5+
gitlab_registration_token = lookup(jsondecode(data.aws_secretsmanager_secret_version.infra.secret_string), "gitlab_registration_token", "mock_value")
6+
alertmanager_slack_url = lookup(jsondecode(data.aws_secretsmanager_secret_version.infra.secret_string), "alertmanager_slack_url", "mock_value")
7+
alertmanager_slack_channel = lookup(jsondecode(data.aws_secretsmanager_secret_version.infra.secret_string), "alertmanager_slack_channel", "mock_value")
118
}
129

1310
data "aws_secretsmanager_secret" "infra" {

‎terraform/layer2-k8s/eks-kube-prometheus-stack.tf‎

Lines changed: 46 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,19 @@ locals {
77
chart_version = local.helm_releases[index(local.helm_releases.*.id, "kube-prometheus-stack")].chart_version
88
namespace = local.helm_releases[index(local.helm_releases.*.id, "kube-prometheus-stack")].namespace
99
}
10-
grafana_password = local.kube_prometheus_stack.enabled ? random_string.grafana_password[0].result : "test123"
11-
grafana_domain_name = "grafana-${local.domain_suffix}"
12-
prometheus_domain_name = "prometheus-${local.domain_suffix}"
13-
alertmanager_domain_name = "alertmanager-${local.domain_suffix}"
14-
kube_prometheus_stack_values = <<VALUES
10+
grafana_oauth_type = "" # we support three options: without ouath (empty value), github or gitlab. Default is empty
11+
grafana_password = local.kube_prometheus_stack.enabled ? random_string.grafana_password[0].result : "test123"
12+
grafana_gitlab_client_id = lookup(jsondecode(data.aws_secretsmanager_secret_version.infra.secret_string), "grafana_gitlab_client_id", "")
13+
grafana_gitlab_client_secret = lookup(jsondecode(data.aws_secretsmanager_secret_version.infra.secret_string), "grafana_gitlab_client_secret", "")
14+
grafana_gitlab_group = lookup(jsondecode(data.aws_secretsmanager_secret_version.infra.secret_string), "grafana_gitlab_group", "")
15+
grafana_github_client_id = lookup(jsondecode(data.aws_secretsmanager_secret_version.infra.secret_string), "grafana_github_client_id", "")
16+
grafana_github_client_secret = lookup(jsondecode(data.aws_secretsmanager_secret_version.infra.secret_string), "grafana_github_client_secret", "")
17+
grafana_github_team_ids = lookup(jsondecode(data.aws_secretsmanager_secret_version.infra.secret_string), "grafana_github_team_ids", "")
18+
grafana_github_allowed_organizations = lookup(jsondecode(data.aws_secretsmanager_secret_version.infra.secret_string), "grafana_github_allowed_organizations", "")
19+
grafana_domain_name = "grafana-${local.domain_suffix}"
20+
prometheus_domain_name = "prometheus-${local.domain_suffix}"
21+
alertmanager_domain_name = "alertmanager-${local.domain_suffix}"
22+
kube_prometheus_stack_values = <<VALUES
1523
# Prometheus Server parameters
1624
prometheus:
1725
ingress:
@@ -65,7 +73,7 @@ prometheusOperator:
6573
- ON_DEMAND
6674
VALUES
6775

68-
kube_prometheus_stack_grafana_values = <<VALUES
76+
kube_prometheus_stack_grafana_values = <<VALUES
6977
# Grafana settings
7078
grafana:
7179
enabled: true
@@ -89,22 +97,11 @@ grafana:
8997
- hosts:
9098
- ${local.grafana_domain_name}
9199
env:
92-
# all values must be quoted
93-
GF_SERVER_ROOT_URL: "https://${local.grafana_domain_name}"
94-
GF_USERS_ALLOW_SIGN_UP: "false"
95-
GF_AUTH_GITLAB_ENABLED: "true"
96-
GF_AUTH_GITLAB_ALLOW_SIGN_UP: "true"
97-
GF_AUTH_GITLAB_CLIENT_ID: "${local.grafana_gitlab_client_id}"
98-
GF_AUTH_GITLAB_CLIENT_SECRET: "${local.grafana_gitlab_client_secret}"
99-
GF_AUTH_GITLAB_SCOPES: "read_api"
100-
GF_AUTH_GITLAB_AUTH_URL: "https://gitlab.com/oauth/authorize"
101-
GF_AUTH_GITLAB_TOKEN_URL: "https://gitlab.com/oauth/token"
102-
GF_AUTH_GITLAB_API_URL: "https://gitlab.com/api/v4"
103-
GF_AUTH_GITLAB_ALLOWED_GROUPS: "${local.grafana_gitlab_group}"
100+
GF_SERVER_ROOT_URL: https://${local.grafana_domain_name}
101+
GF_USERS_ALLOW_SIGN_UP: false
104102
105103
persistence:
106104
enabled: false
107-
108105
sidecar:
109106
datasources:
110107
enabled: true
@@ -150,7 +147,6 @@ grafana:
150147
logs:
151148
## Dashboard for quick search application logs for loki with two datasources loki and prometheus - https://grafana.com/grafana/dashboards/12019
152149
url: https://grafana-dashboards.maddevs.org/common/aws-eks-base/loki-dashboard-quick-search.json
153-
154150
k8s:
155151
nginx-ingress:
156152
## Dashboard for nginx-ingress metrics - https://grafana.com/grafana/dashboards/9614
@@ -175,8 +171,32 @@ grafana:
175171
values:
176172
- SPOT
177173
VALUES
178-
179-
kube_prometheus_stack_alertmanager_values = <<VALUES
174+
kube_prometheus_stack_grafana_gitlab_oauth_values = <<VALUES
175+
grafana:
176+
env:
177+
GF_AUTH_GITLAB_ENABLED: true
178+
GF_AUTH_GITLAB_ALLOW_SIGN_UP: true
179+
GF_AUTH_GITLAB_CLIENT_ID: ${local.grafana_gitlab_client_id}
180+
GF_AUTH_GITLAB_CLIENT_SECRET: ${local.grafana_gitlab_client_secret}
181+
GF_AUTH_GITLAB_SCOPES: read_api
182+
GF_AUTH_GITLAB_AUTH_URL: https://gitlab.com/oauth/authorize
183+
GF_AUTH_GITLAB_TOKEN_URL: https://gitlab.com/oauth/token
184+
GF_AUTH_GITLAB_API_URL: https://gitlab.com/api/v4
185+
GF_AUTH_GITLAB_ALLOWED_GROUPS: ${local.grafana_gitlab_group}
186+
VALUES
187+
kube_prometheus_stack_grafana_github_oauth_values = <<VALUES
188+
GF_AUTH_GITHUB_ENABLED: true
189+
GF_AUTH_GITHUB_ALLOW_SIGN_UP: true
190+
GF_AUTH_GITHUB_CLIENT_ID: ${local.grafana_github_client_id}
191+
GF_AUTH_GITHUB_CLIENT_SECRET: ${local.grafana_github_client_secret}
192+
GF_AUTH_GITHUB_SCOPES: user:email,read:org
193+
GF_AUTH_GITHUB_AUTH_URL: https://github.com/login/oauth/authorize
194+
GF_AUTH_GITHUB_TOKEN_URL: https://github.com/login/oauth/access_token
195+
GF_AUTH_GITHUB_API_URL: https://api.github.com/user
196+
GF_AUTH_GITHUB_TEAM_IDS: ${local.grafana_github_team_ids}
197+
GF_AUTH_GITHUB_ALOWED_ORGANISATIONS: ${local.grafana_github_allowed_organizations}
198+
VALUES
199+
kube_prometheus_stack_alertmanager_values = <<VALUES
180200
# Alertmanager parameters
181201
alertmanager:
182202
enabled: false
@@ -397,11 +417,13 @@ resource "helm_release" "prometheus_operator" {
397417
namespace = module.monitoring_namespace[count.index].name
398418
max_history = var.helm_release_history_size
399419

400-
values = [
420+
values = compact([
401421
local.kube_prometheus_stack_values,
402422
local.kube_prometheus_stack_grafana_values,
423+
local.grafana_oauth_type == "gitlab" ? local.kube_prometheus_stack_grafana_gitlab_oauth_values : null,
424+
local.grafana_oauth_type == "github" ? local.kube_prometheus_stack_grafana_github_oauth_values : null,
403425
local.kube_prometheus_stack_alertmanager_values
404-
]
426+
])
405427

406428
}
407429

0 commit comments

Comments
 (0)