Skip to content

Commit 022786d

Browse files
duanhongyiduanhongyi
committed
feat(grafana): add oauth2 proxy
1 parent edaab1c commit 022786d

37 files changed

Lines changed: 6959 additions & 3067 deletions

‎Makefile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ SHELL := /bin/bash
22

33
# grafana share/use the following targets/exports
44
SHORT_NAME ?= grafana
5-
SHELL_SCRIPTS = rootfs/usr/bin/start-grafana
5+
SHELL_SCRIPTS = rootfs/usr/share/grafana/oauth2
66

77
BUILD_TAG ?= git-$(shell git rev-parse --short HEAD)
88
DRYCC_REGISTRY ?= ${DEV_REGISTRY}
@@ -12,7 +12,7 @@ PLATFORM ?= linux/amd64,linux/arm64
1212
include includes.mk
1313
include versioning.mk
1414

15-
TEST_ENV_PREFIX := podman run --rm -v ${CURDIR}:/bash -w /bash ${DEV_REGISTRY}/drycc/go-dev
15+
TEST_ENV_PREFIX := podman run --rm -v ${CURDIR}:/bash -w /bash ${DEV_REGISTRY}/drycc/python-dev
1616

1717
build: podman-build
1818
push: podman-push
@@ -31,7 +31,7 @@ clean: check-podman
3131
test: test-style
3232

3333
test-style:
34-
${TEST_ENV_PREFIX} shellcheck $(SHELL_SCRIPTS)
34+
${TEST_ENV_PREFIX} flake8 --show-source --max-line-length=100 $(SHELL_SCRIPTS)
3535

3636
.PHONY: build push podman-build clean upgrade deploy test test-style
3737

‎charts/grafana/templates/_helpers.tmpl‎

Lines changed: 61 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -9,31 +9,60 @@ env:
99
valueFrom:
1010
fieldRef:
1111
fieldPath: metadata.namespace
12-
{{- if .Values.prometheusUrl }}
13-
- name: "PROMETHEUS_URL"
14-
value: "{{ .Values.prometheusUrl }}"
15-
{{- else if .Values.prometheus.enabled }}
16-
- name: "PROMETHEUS_URL"
17-
value: "http://$(DRYCC_CONTROLLER_API_SERVICE_HOST):$(DRYCC_CONTROLLER_API_SERVICE_PORT)/v2/prometheus"
12+
{{- if (.Values.valkeyUrl) }}
13+
- name: DRYCC_VALKEY_URL
14+
value: "{{ .Values.valkeyUrl }}"
15+
{{- else if .Values.valkey.enabled }}
16+
- name: DRYCC_VALKEY_PASSWORD
17+
valueFrom:
18+
secretKeyRef:
19+
name: valkey-creds
20+
key: password
21+
- name: DRYCC_VALKEY_URL
22+
value: "redis://:$(DRYCC_VALKEY_PASSWORD)@drycc-valkey.{{.Release.Namespace}}.svc.{{.Values.global.clusterDomain}}:16379/0"
1823
{{- end }}
19-
- name: "VALKEY_LOCATION"
20-
value: {{ ternary "on-cluster" "off-cluster" .Values.valkey.enabled }}
21-
- name: "STORAGE_LOCATION"
22-
value: {{ ternary "on-cluster" "off-cluster" .Values.storage.enabled }}
23-
- name: "DATABASE_LOCATION"
24-
value: {{ ternary "on-cluster" "off-cluster" .Values.database.enabled }}
25-
- name: "PASSPORT_LOCATION"
26-
value: {{ ternary "on-cluster" "off-cluster" .Values.passport.enabled }}
27-
- name: "REGISTRY_LOCATION"
28-
value: {{ ternary "on-cluster" "off-cluster" .Values.registry.enabled }}
29-
- name: "PROMETHEUS_LOCATION"
30-
value: {{ ternary "on-cluster" "off-cluster" .Values.prometheus.enabled }}
31-
- name: "DRYCC_GATEWAY_SCHEME"
24+
{{- if .Values.victoriametricsUrl }}
25+
- name: "DRYCC_VICTORIAMETRICS_URL"
26+
value: "{{ .Values.victoriametricsUrl }}"
27+
{{- else if .Values.victoriametrics.enabled }}
28+
- name: "DRYCC_VICTORIAMETRICS_USERNAME"
29+
valueFrom:
30+
secretKeyRef:
31+
name: victoriametrics-vmauth-creds
32+
key: username
33+
- name: "DRYCC_VICTORIAMETRICS_PASSWORD"
34+
valueFrom:
35+
secretKeyRef:
36+
name: victoriametrics-vmauth-creds
37+
key: password
38+
- name: "DRYCC_VICTORIAMETRICS_URL"
39+
value: "http://$(DRYCC_VICTORIAMETRICS_USERNAME):$(DRYCC_VICTORIAMETRICS_PASSWORD)@drycc-victoriametrics-vmauth.{{$.Release.Namespace}}.svc.{{$.Values.global.clusterDomain}}:8427/select/0/prometheus"
40+
{{- end }}
41+
{{- if .Values.passport.enabled}}
42+
- name: "DRYCC_PASSPORT_URL"
3243
{{- if .Values.global.certManagerEnabled }}
33-
value: https
44+
value: https://drycc-passport.{{ .Values.global.platformDomain }}
3445
{{- else }}
35-
value: http
36-
{{- end}}
46+
value: http://drycc-passport.{{ .Values.global.platformDomain }}
47+
{{- end }}
48+
- name: DRYCC_PASSPORT_KEY
49+
valueFrom:
50+
secretKeyRef:
51+
name: passport-creds
52+
key: drycc-passport-grafana-key
53+
- name: DRYCC_PASSPORT_SECRET
54+
valueFrom:
55+
secretKeyRef:
56+
name: passport-creds
57+
key: drycc-passport-grafana-secret
58+
{{- else }}
59+
- name: DRYCC_PASSPORT_URL
60+
value: "{{ .Values.passportUrl }}"
61+
- name: DRYCC_PASSPORT_KEY
62+
value: "{{ .Values.passportKey }}"
63+
- name: DRYCC_PASSPORT_SECRET
64+
value: "{{ .Values.passportSecret }}"
65+
{{- end }}
3766
- name: GF_DATABASE_TYPE
3867
value: postgres
3968
{{- if (.Values.databaseUrl) }}
@@ -53,49 +82,22 @@ env:
5382
- name: GF_DATABASE_URL
5483
value: "postgres://$(GF_DATABASE_USER):$(GF_DATABASE_PASSWORD)@drycc-database.{{.Release.Namespace}}.svc.{{.Values.global.clusterDomain}}:5432/grafana"
5584
{{- end }}
56-
{{- if not (.Values.environment.GF_SECURITY_ADMIN_USER) }}
5785
- name: "GF_SECURITY_ADMIN_USER"
58-
value: {{ randAlphaNum 32 }}
59-
{{- end}}
60-
{{- if not (.Values.environment.GF_SECURITY_ADMIN_PASSWORD) }}
61-
- name: "GF_SECURITY_ADMIN_PASSWORD"
62-
value: {{ randAlphaNum 32 }}
63-
{{- end}}
64-
{{- if not (.Values.environment.GF_SECURITY_SECRET_KEY) }}
65-
- name: "GF_SECURITY_SECRET_KEY"
66-
value: {{ randAlphaNum 32 }}
67-
{{- end}}
68-
- name: "GF_SERVER_ROOT_URL"
69-
value: $(DRYCC_GATEWAY_SCHEME)://drycc-grafana.{{ .Values.global.platformDomain }}
70-
{{- if .Values.passport.enabled}}
71-
- name: GF_AUTH_GENERIC_OAUTH_AUTH_URL
72-
value: $(DRYCC_GATEWAY_SCHEME)://drycc-passport.{{ .Values.global.platformDomain }}/oauth/authorize/
73-
- name: GF_AUTH_GENERIC_OAUTH_TOKEN_URL
74-
value: $(DRYCC_GATEWAY_SCHEME)://drycc-passport.{{ .Values.global.platformDomain }}/oauth/token/
75-
- name: GF_AUTH_GENERIC_OAUTH_API_URL
76-
value: $(DRYCC_GATEWAY_SCHEME)://drycc-passport.{{ .Values.global.platformDomain }}/oauth/userinfo/
77-
- name: GF_AUTH_GENERIC_OAUTH_CLIENT_ID
7886
valueFrom:
7987
secretKeyRef:
80-
name: passport-creds
81-
key: drycc-passport-grafana-key
82-
- name: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
88+
name: grafana-creds
89+
key: admin-username
90+
- name: "GF_SECURITY_ADMIN_PASSWORD"
8391
valueFrom:
8492
secretKeyRef:
85-
name: passport-creds
86-
key: drycc-passport-grafana-secret
93+
name: grafana-creds
94+
key: admin-password
95+
- name: "GF_SERVER_ROOT_URL"
96+
{{- if .Values.global.certManagerEnabled }}
97+
value: https://drycc-grafana.{{ .Values.global.platformDomain }}
8798
{{- else }}
88-
- name: GF_AUTH_GENERIC_OAUTH_AUTH_URL
89-
value: {{ .Values.passportUrl }}/oauth/authorize/
90-
- name: GF_AUTH_GENERIC_OAUTH_TOKEN_URL
91-
value: {{ .Values.passportUrl }}/oauth/token/
92-
- name: GF_AUTH_GENERIC_OAUTH_API_URL
93-
value: {{ .Values.passportUrl }}/oauth/userinfo/
94-
- name: GF_AUTH_GENERIC_OAUTH_CLIENT_ID
95-
value: "{{ .Values.passportKey }}"
96-
- name: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
97-
value: "{{ .Values.passportSecret }}"
98-
{{- end }}
99+
value: http://drycc-grafana.{{ .Values.global.platformDomain }}
100+
{{- end}}
99101
- name: GF_UNIFIED_ALERTING_HA_PEERS
100102
value: "drycc-grafana.{{.Release.Namespace}}.svc.{{.Values.global.clusterDomain}}:9094"
101103
- name: GF_UNIFIED_ALERTING_HA_ADVERTISE_ADDRESS

‎charts/grafana/templates/grafana-configmap.yaml‎

Lines changed: 62 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -6,15 +6,42 @@ metadata:
66
labels:
77
heritage: drycc
88
data:
9+
Caddyfile: |
10+
{
11+
order reverse_proxy before encode
12+
auto_https off
13+
log {
14+
output stdout
15+
}
16+
}
17+
:5000 {
18+
handle /oauth2/* {
19+
reverse_proxy 127.0.0.1:4000
20+
}
21+
22+
handle {
23+
forward_auth 127.0.0.1:4000 {
24+
uri /oauth2/userinfo
25+
copy_headers Remote-User Remote-Name Remote-Email
26+
header_up -Connection
27+
header_up X-Real-IP {remote_host}
28+
@error status 401
29+
handle_response @error {
30+
redir * /oauth2/sign_in?redirect={scheme}://{host}{uri}
31+
}
32+
}
33+
reverse_proxy 127.0.0.1:3000
34+
}
35+
}
936
grafana.ini: |
1037
app_mode = production
1138
1239
[paths]
1340
data = /var/lib/grafana
1441
home = /usr/share/grafana
1542
logs = /var/log/grafana
16-
plugins = /var/lib/grafana/plugins
17-
provisioning = /opt/drycc/grafana/conf/provisioning
43+
plugins = /usr/share/grafana/plugins
44+
provisioning = /usr/share/grafana/provisioning
1845
1946
[server]
2047
http_port = 3000
@@ -26,9 +53,8 @@ data:
2653
reporting_enabled = false
2754
2855
[security]
29-
admin_user = drycc
30-
admin_password = drycc
3156
admin_email = admin@drycc.cc
57+
secret_key = KSJRZP0RIhO7P14e1TykTEzWuJhBobAj
3258
login_remember_days = 7
3359
cookie_username = grafana_user
3460
cookie_remember_name = grafana_remember
@@ -37,31 +63,31 @@ data:
3763
[users]
3864
allow_sign_up = false
3965
allow_org_create = false
40-
auto_assign_org = true
41-
auto_assign_org_id = 1
66+
auto_assign_org = false
4267
login_hint = email or username
4368
4469
[auth]
4570
disable_login_form = true
46-
47-
[auth.anonymous]
48-
enabled = false
49-
org_name = Main Org.
71+
disable_signout_menu = false
5072
5173
[auth.basic]
5274
enabled = true
5375
54-
[auth.generic_oauth]
76+
[auth.proxy]
5577
enabled = true
56-
name = Drycc OAuth
57-
auto_login = true
58-
scopes = email,profile,openid
59-
allow_sign_up = true
60-
tls_skip_verify_insecure = true
61-
org_attribute_path = roles
62-
org_mapping = admin:*:Admin staff:*:Editor users:2:Viewer
63-
role_attribute_path = (is_active && ((is_superuser && 'GrafanaAdmin') || (is_staff && 'Editor'))) || 'None'
64-
allow_assign_grafana_admin = true
78+
header_name = Remote-User
79+
header_property = username
80+
auto_sign_up = true
81+
sync_ttl = 15
82+
headers = Name:Remote-Name Email:Remote-Email
83+
enable_login_token = false
84+
85+
[live]
86+
max_connections = 100
87+
message_size_limit = 65536
88+
allowed_origins = *
89+
ha_engine = redis
90+
ha_prefix = "grafana:live"
6591
6692
[emails]
6793
welcome_email_on_sign_up = false
@@ -74,13 +100,25 @@ data:
74100
[log.console]
75101
level = info
76102
103+
[quota]
104+
enabled = true
105+
org_user = 2
106+
org_dashboard = 20
107+
org_data_source = 5
108+
org_api_key = 2
109+
org_alert_rule = 20
110+
user_org = 2
111+
alerting_rule_group_rules = 20
112+
alerting_rule_evaluation_results = 20
113+
77114
[unified_alerting]
78115
enabled = true
79-
disabled_orgs = 2
80116
ha_peer_timeout = 15s
81117
ha_reconnect_timeout = 2m
82118
ha_listen_address = 0.0.0.0:9094
119+
evaluation_timeout = 3s
120+
max_attempts = 3
121+
min_interval = 1m
83122
84-
[dashboards.json]
85-
enabled = true
86-
path = /usr/share/grafana/dashboards
123+
[plugins]
124+
plugin_admin_enabled = false

0 commit comments

Comments
 (0)